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ABSTRACT 


A communication system having a wireless trunk for con- 
necting multiple phone lines over wireless communication 
links to a cellular network comprises a central telephone 
switch, such as a private branch exchange or key system, 
connected through one or more trunk lines to a wireless 
access communication unit. The wireless access communi- 
cation unit preferably comprises a separate subscriber inter- 
face for each trunk line from the central telephone switch. 
The wireless access communication unit collects data from 
each of the subscriber interfaces, formats the data into a 
format compatible with an over-the-air protocol, and trans- 
mits the information over one or more wireless channels to 
a cellular base station. The wireless access communication 
unit thereby connects calls received from the central tele- 
phone switch's trunk lines over a wireless trunk to a net- 
work. A controller within the wireless access communica- 
tion unit interfaces the subscriber interfaces with a radio 
transceiver, and assists in the conversion of data from a 
format suitable for wireless transmission. Authentication is 
carried out separately for each of the subscriber interfaces, 
thereby allowing the wireless access communication unit to 
represent itself as multiple individual subscribers to the 
network. Upon each initial registration, each subscriber 
interface derives its own ciphering key from a stored user 
key and uses it thereafter for encryption and decryption. 
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AUTHENTICATION AND SECURITY IN 
WIRELESS COMMUNICATION SYSTEM 

BACKGROUND OF THE INVENTION 
[0001] 1) Field of the Invention 

[0002] The field of the present invention relates to a 
method and system for providing communication services, 
and more particularly to techniques for authentication and 
security in a wireless communication system. 

[0003] 2) Background 

[0004] Localized telephone switching systems such as 
private branch exchanges (PBXs) and key type systems have 
for many years been available to business offices and other 
establishments as an alternative or adjunct to public tele- 
phone service. A PBX or key system allows users connected 
to the system to place intra -system telephone calls without 
accessing the public telephone service. Such a system can 
provide significant economic benefits, particularly if intra- 
system telephone traffic is heavy. 

[0005] On the other hand, when callers using a PBX or key 
system need to place a call to a party not connected to the 
system, such outside calls must typically be routed through 
the PBX or key system controller over landlines to the public 
telephone company. To accommodate such dual functional- 
ity (i.e., intra-system call support and outside call support), 
special-purpose telephones have been developed for con- 
nection to a PBX or key system to allow manual routing of 
telephone calls. For example, deskset telephones can be 
provided with buttons corresponding to different telephone 
lines. By depressing the appropriate button, the user selects 
between certain designated lines for calls within the system, 
or different designated lines for calls over the public tele- 
phone network, 

[0006] In other PBX and key systems call routing over the 
selected lines may be automatic. For example, the user may 
select an intra-system call or a call over the public telephone 
network according to the first digit dialed, and the PBX or 
key system then analyzes the first digit and routes the call to 
the proper destination using the appropriate vehicle. 

[0007] While PBX and key systems are useful for provid- 
ing economical coverage within a private local telephone 
system, for long distance the PBX users or key system users 
may still be required to rely on a local exchange carrier 
(LEC) whose landlines are connected to the PBX. The local 
exchange carrier then routes the call to along distance 
carrier. Because the user must pay both the local exchange 
carrier and long distance carrier for each long distance 
telephone call, long distance telephone service can be quite 
costly, particularly if the volume of long distance calls is 
large. 

[0008] Besides high costs for long distance service, 
another potential disadvantage of existing PBX or key 
telephone systems is that deployment can be difficult or 
expensive in remote areas. For example, if long distance 
service or other public network services are required, then 
deployment of a PBX or key system is generally limited to 
where landlines have been laid, so that the PBX or key 
system can have a connection to a local exchange carrier 
which connects to the long distance provider. If no landlines 
are present in the desired deployment location, then it can be 


expensive to connect landlines to provide long distance 
access for the PBX or key system. Also, conventional PBX 
or key systems are generally not very mobile where they 
require an interface with landlines for long distance access 
or other types of public network services. 

[0009] There is a need for a communication system having 
the ability of a PBX or key telephone system to manage local 
area calls, yet also which can provide access to lower cost, 
reliable long distance or other network services. There is 
also a need for a versatile mechanism for allowing PBX or 
key type systems to achieve relatively inexpensive access to 
network resources and long distance coverage. There is also 
a need for a communication system that employs a robust, 
flexible protocol for providing long distance coverage or 
other network services to local users of a PBX, key system 
or other type of local area network. 

SUMMARY OF THE INVENTION 

[0010] The invention provides in one aspect a communi- 
cation system having a wireless trunk for connecting mul- 
tiple phone lines over wireless communication links to a 
cellular network. In one embodiment of the invention, a 
central telephone switch or customer premises equipment 
(CPE), such as a private branch exchange or key system, is 
connected through one or more trunks to a wireless access 
communication unit. The wireless access communication 
unit provides the CPE with one or more wireless commu- 
nication channels to a cellular network. Calls may be selec- 
tively routed by the CPE over landlines to a network or, 
instead, to the wireless access communication unit, thereby 
bypassing landlines. Multiple wireless access communica- 
tion units in a geographical region can communicate with a 
single base station of the cellular network, so long as the 
base station capacity and current traffic load permit. 

[0011] In another aspect of the invention, a wireless access 
communication unit is provided which has multiple trunk 
interfaces for connection to a CPE, and a radio transceiver 
for establishing one or more wireless communication links 
to a cellular network. Each trunk interface is connected to a 
line card comprising a vocoder and a subscriber interface. A 
controller interfaces the line cards with the radio transceiver, 
and assists in the conversion of data from a format suitable 
for wireless transmission to a format suitable for transmis- 
sion over the CPE trunk, and vice versa. Data communicated 
between the wireless access communication unit and the 
network may be encrypted at the wireless access commu- 
nication unit and decrypted at the mobile switching center or 
else at a separate transcoding unit interposed between the 
mobile switching center and the base station subsystem. 

[0012] In another aspect of the invention, each trunk 
interface of a wireless access communication unit is indi- 
vidually authenticated and derives an individual and unique 
ciphering key for encryption and decryption of data. A user 
key is stored at each trunk interface and at a central register 
of the network. During an authentication procedure, an 
authentication parameter (e.g., a random number) is trans- 
ferred to the trunk interface, which generates a signed 
response and a ciphering key based upon the stored user key. 
The network generates a matching signed response and 
ciphering key at its end. The wireless access communication 
unit transmits the signed response back to the network, 
where it is verified before further communication is allowed 
to proceed. 
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[0013] In a preferred embodiment of the invention, the 
wireless access communication unit operates according to a 
protocol utilizing aspects of frequency division multiple 
access (FDMA), time division multiple access (TDMA) 
and/or code division multiple access (CDMA), whereby 
communication channels are assigned to the wireless com- 
munication unit on a demand basis. In a preferred embodi- 
ment, communication between the wireless access commu- 
nication unit and a base station of the cellular network is 
carried out over a plurality of wireless duplex communica- 
tion channels, one channel for each CPE trunk, with base 
transmissions in time slots on one frequency band and user 
transmissions (including those from the wireless access 
communication unit) in time slots on a different frequency 
band. In such an embodiment, the user time slots may be 
offset in time from the base time slots, and radio transmis- 
sions may be carried out using spread spectrum techniques. 

[0014] In another aspect of the invention, the wireless 
access communication unit registers each CPE trunk to 
which it is connected such that each CPE trunk appears as 
a subscriber to the network. Each CPE trunk may therefore 
be addressed by a unique subscriber identifier. The wireless 
access communication unit preferably utilizes aspects of 
GSM signaling to communicate information to the network, 
such that communication with a GSM -based network is 
carried out transparently by the wireless access communi- 
cation unit. 

[0015] In yet another aspect of the invention, the wireless 
access communication unit periodically re-registers each of 
its CPE trunks. The base station receives and monitors the 
re- registration signals from the wireless access communica- 
tion unit and, if the re -registration signals are absent for a 
predefined period of time, issues an alarm message to the 
network. The wireless access communication unit may be 
provided with a unique equipment identifier so that the base 
station can correlate the different wireless links to a single 
wireless access communication unit. 

[0016] Further embodiments, modifications, variations 
and enhancements of the invention are also disclosed herein. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0017] FIG. 1 is a diagram of an overall system architec- 
ture in accordance with a preferred embodiment of the 
present invention. 

[0018] FIG. 2 is a block diagram of a basic architecture 
for a wireless access communication unit in accordance with 
various aspects of the present invention. 

[0019] FIG. 3 is a diagram of a software architecture for 
the wireless access communication unit of FIG. 2. 

[0020] FIG. 4 is a block diagram of a basic architecture 
for a base station. 

[0021] FIG. 5 is a diagram of a software structure for the 
base station of FIG. 4. 

[0022] FIG. 6 is a block diagram illustrating addressing of 
multiple trunks connected to a wireless access communica- 
tion unit according to a preferred embodiment of the present 
invention. 

[0023] FIG. 7 is a diagram illustrating an interface sig- 
naling structure between a base station and a base station 
controller. 


[0024] FIG. 8 is an abstract diagram of a system protocol 
architecture. 

[0025] FIG. 9 is a diagram illustrating a division of bearer 
path functions among a wireless access communication unit 
(CPRU), base station and base station controller components 
of a preferred communication system. 

[0026] FIG. 10 is a diagram showing interfaces between 
the different components of a preferred system, 

[0027] FIG. 11 is a diagram of multiple wireless access 
communication units in different location areas connected to 
a single base station controller. 

[0028] FIG. 12 is a call flow diagram for a network-level 
registration procedure. 

[0029] FIG. 13 is a call flow diagram for a network-level 
de-reistration procedure. 

[0030] FIG. 14 is a call flow diagram for a successful 
outgoing call setup without PSTN interworking. 

[0031] FIG. 15 is a call flow diagram for a successful 
outgoing call setup with PSTN interworking. 

[0032] FIG. 16 is a timing diagram of an over-the-air 
protocol that may be used in the communication system 
shown in FIG. 1. 

[0033] FIG. 17 is a timing diagram of an alternative 
over-the-air protocol for the communication system shown 
in FIG. 1. 

[0034] FIG. 18 is a diagram showing an authentication 
process in accordance with a preferred embodiment of the 
invention. 

DETAILED DESCRIPTION OF PREFERRED 
EMBODIMENTS 

[0035] FIG. 1 is a diagram showing an overall system 
architecture of a communication system 101 in accordance 
with a preferred embodiment of the present invention. In the 
system architecture illustrated in FIG. 1, a plurality of 
telephone stations 102 are connected to a central telephone 
switch 105. It will be understood that telephone stations 102 
could comprise telephones, modems, fax machines, or other 
devices that are capable of communicating over a completed 
call connection. The central telephone switch 105 will be 
referred to herein as a "customer premises equipment" or 
"CPE." The CPE 105 may comprise, for example, a private- 
branch exchange (PBX) system or a key system. The design 
of various types of PBX and key systems is well known in 
the art. 

[0036] In the preferred embodiment depicted in FIG. 1, 
the CPE 105 is connected to both a public switched tele- 
phone network (PSTN) 125 and a wireless access commu- 
nication unit 106 (also referred to occasionally herein, or in 
the drawings, as a "customer premises radio unit" or 
"CPRU"). As described in more detail hereinafter, in a 
preferred embodiment calls are selectively placed over the 
PSTN 125 and the wireless access communication unit 106 
according to the type of call. The wireless access commu- 
nication unit 106 communicates over a wireless trunk 108 
(which comprises a plurality of wireless communication 
links) to a base station 109. The base station 109 is con- 
nected, along with other base stations 109 in adjacent or 
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nearby geographical regions, to a base station controller 112. 
The base station controller 112 is connected to a transcoding 
unit 115, which is connected to a mobile switching center 
(MSC) 116. Optionally, the base station controller 112 may 
be connected directly to the mobile switching center 116, 
without the intermediary transcoding unit 115. The mobile 
switching center 116 is connected to the PSTN 125. 

[0037] In addition to being connected to the transcoding 
unit 115 or, optionally, the MSC 116, the base station 
controller 112 is also connected to an operations and main- 
tenance center (OMQ 120, which is in turn connected to an 
operations support system (OSS) 122. The mobile switching 
center 116 is connected to a home location register and 
authentication center (HLR/AuC) 123 and to the operations 
support system 122, as shown in FIG. 1. The base station 
109 may also be connected to a local management terminal 
121. 

[0038] As further described herein, the invention provides 
in one aspect techniques for authentication and security in a 
wireless communication system, such as the communication 
system depicted in FIG. 1. The wireless access communi- 
cation unit 106 preferably supports multiple trunks or user 
interface connections which are coupled to the CPE 105, and 
authentication is performed separately for each such trunk or 
user interface connection. In one aspect, the wireless access 
communication unit 106 is treated as an aggregation of 
individual subscribers by the network. Each trunk or user 
interface connection supported by the wireless access com- 
munication unit 106 derives its own ciphering key based 
upon an authentication parameter received from the net- 
work. The wireless access communication unit 106 therefore 
provides for multiple encrypted bearer paths routed through 
the network, with each bearer path having its own unique 
encryption pattern. Further details relating to preferred 
authentication and security techniques are described later 
herein, after a description of some of the basic components 
of a preferred system and operation thereof. 

[0039] In the preferred communication system 101 shown 
in FIG. 1, calls may be placed from telephone stations 102 
directly over the PSTN 125 (i.e., over a landline connec- 
tion), or over the wireless trunk 108 to the PSTN 125 by 
utilizing the wireless access communication Unit 106. When 
a call is to be initiated at one of the telephone stations 102, 
it may be routed either directly to the PSTN 125 or to the 
wireless access communication unit 106. The routing of the 
call may be either based on manual selection, or accom- 
plished automatically based on the number dialed, as further 
described herein. In a preferred embodiment, local telephone 
calls are routed directly to the PSTN 125, while long 
distance telephone calls are routed through the wireless 
access communication unit 106. 

[0040] Operation of the system shown in FIG. 1 may 
depend in part on the nature of the CPE 105. As noted 
previously, the CPE 105 may comprise, for example, a PBX 
or a key -type system. In an embodiment where the CPE 105 
comprises a PBX, the PBX is preferably capable of routing 
an outgoing call placed from a telephone station 102 to the 
PSTN 125 or to the wireless access communication unit 106 
based on either an access digit or the telephone number 
dialed by the user. The user may, for example, dial a certain 
first digit (e.g. an *8*) for access to the wireless access 
communication unit 106, and a different first digit (e.g., a 


'9') for direct LEC access to the PSTN 125. In this manner, 
the user could, for example, access the wireless access 
communication unit 106 to make outgoing long distance 
telephone calls, or the PSTN 125 for other types of outgoing 
calls. Alternatively, some types of PBXs can be configured 
to analyze the dialed number, and to route long distance and 
local calls. Utilizing this ability, the PBX can be configured 
to route long distance calls through the wireless access 
communication unit 106 and local or emergency calls 
through the PSTN 125. 

[0041] In an embodiment where the CPE 105 comprises a 
key system, the user may manually select a line (either for 
the wireless access communication unit 106 or the PSTN 
125) by depressing a key on the telephone deskset. The user 
could, for example, select the call processing unit 106 for 
outgoing long distance calls, and the PSTN 125 for other 
types of outgoing calls. Some key systems can, like certain 
PBXs, be configured to analyze the dialed number, and to 
route a call either to the wireless access communication unit 
106 or the PSTN 125 depending on the initial digits of the 
call and/or the number of digits dialed. In this manner, the 
key system can, for example, be configured to route long 
distance calls through the wireless access communication 
unit 106, and local or emergency calls through the PSTN 
125. 

[0042] In alternative embodiments, the system may be 
configured with less flexibility but a potentially simpler 
architecture. For example, the system can be configured 
such that all incoming calls are routed directly from the 
PSTN 125 to the CPE 105, and that all outgoing local calls 
(whether voice or data), all outgoing long distance data calls, 
and all TTY calls for persons with disabilities are also routed 
directly through the PSTN 125. In such an embodiment, the 
wireless access communication unit 106 would generally 
provide outgoing long distance voice communication capa- 
bilities. 

[0043] The CPE 105 is connected to the wireless access 
communication unit 106 across a CPE trunk interface 104. 
The CPE trunk interface 104 comprises a plurality of CPE 
trunks, each of which may comprise, for example, loop-start 
trunks or ground-start trunks. The design of both loop-start 
trunks and ground-start trunks is well known in the art. As 
is also well known to the practitioner in the art, both 
loop-start trunks and ground -start trunks can be supported 
by the same local area switching equipment (i.e, the same 
PBX or KTS). 

[0044] In an embodiment in which the CPE 105 comprises 
a PBX, the PBX preferably has certain operating character- 
istics. In addition to supporting loop-start trunks or ground- 
start trunks (or both) on the CPE trunk interface 104 between 
the PBX and the wireless access communication unit 106, 
the PBX also preferably supports DTMF address signaling 
on the loop-start trunks or ground-start trunks. The PBX 
may be configured to route calls through either the PSTN 
125 or the wireless access communication unit 106, as 
described previously, and therefore has the ability to identify 
which trunks lead to the PSTN 125 and which trunks lead to 
the wireless access communication unit 106. The PBX 
preferably has the ability to specify the order in which the 
trunk groups are tried when an outgoing call is placed, and 
to re-route outgoing long-distance calls through the PSTN 
125 instead of the wireless access communication unit 106 
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in case of access problems from the wireless access com- 
munication unit 106 to the wireless system. 

[0045] In an embodiment where the CPE 105 comprises a 
key, telephone system (KTS), the KTS preferably has certain 
operational characteristics. In addition to being configured 
to support loop-start trunks or ground-start trunks (or both) 
on the CPE trunk interface 104 between the KTS and the 
wireless access communication unit 106, the KTS also 
preferably supports DTMF address signaling on the loop- 
start trunks or ground-start trunks, and has the ability to 
route calls through either the PSTN 125 or the wireless 
access communication unit 106, as described above. While 
not essential, the KTS may also be provided with supple- 
mentary call support features and a route selection feature 
(i.e., the ability to identify trunk groups leading to the 
wireless access communication unit 106 and the PSTN 125, 
and to specify on the KTS the order in which the trunk 
groups should be tried). If a route selection feature is 
provided, the KTS should have the ability to re-route out- 
going long-distance calls through the PSTN 125 instead of 
the wireless access communication unit 106, in case there 
arc access problems from the wireless access communica- 
tion unit 106 to the wireless system. 

[0046] The wireless access communication unit 106 acts 
as the gateway for wireless trunk access to the CPE 105 via 
the wireless system, and correlates the individual CPE 
trunks with wireless communication links such that calls 
from the CPE 105 can be completed over a wireless net- 
work. FIG. 6 is a diagram illustrating an embodiment of a 
wireless access communication unit 605 connected to a CPE 
105 (see FIG. 1) across a plurality of CPE trunks 602 (in this 
example, four CPE trunks 602). The wireless access com- 
munication unit 605 also is connected over a plurality of 
wireless communication links (or 'pipes') 609 to a wireless 
network and, in particular, to a base station (not shown in 
FIG. 6). The wireless access communication unit 605 estab- 
lishes the wireless communication links 609 and correlates 
therewith the CPE trunks 602, so that communication for a 
particular CPE trunk 602 is carried out over an assigned 
wireless communication link 609. Users connected to the 
CPE 105 can obtain access to the wireless access commu- 
nication unit 605 (and, hence, to the wireless network) by 
being connected through the CPE 105 to one of CPE trunks 
602. In this manner, a potentially large number of users 
connected to the CPE 105 can have the ability to complete 
calls to the wireless network, with the number of users able 
to make calls simultaneously equaling the number of CPE 
trunks 602 (and wireless communication links 609) avail- 
able. 

[0047] Various components of the communication system 
shown in FIG. 1 will now be described in more detail. In 
addition, a detailed description of the preferred system 
interworking, protocols and related information appears 
hereinafter, and also appears in copending U.S. patent 

application Ser. No. (attorney docket 223/110). Ser. 

No. (attorney docket 228/118), Ser. No. 

(attorney docket 228/119), Ser. No, (attorney docket 

228/121), Ser. No. (attorney docket 228/122), and 

Ser. No. (attorney docket 228/123), each of which is 

filed concurrently herewith, and each of which is hereby 
incorporated by reference as if set forth fully herein. 

[0048] The wireless access communication unit 106, as 
noted, acts as the gateway for the CPE 105 to the wireless 


network, and preferably performs a variety of functions. In 
a preferred embodiment, the wireless access communication 
unit 106 performs off-hook-detection for outgoing calls and 
supports provision of a dial tone to the CPE 105 (and thereby 
to the telephone station 102 initiating the call). The wireless 
access communication unit 106 also initiates acquisition of 
a wireless communication channel (such as an over-the-air 
time slot, for example, if the wireless network is a TDMA 
and/or TDD system), and initiates call control procedures. 
During call establishment, the wireless access communica- 
tion unit 106 detects dialed address digits (i.e., DTMF tones) 
and passes the received digits via call control signaling to the 
network. The wireless access communication unit 106 
decides whether to launch a normal or emergency call 
depending upon an end-of-dialing indication received from 
the base station 109 indicating the type of call (based on 
digit analysis performed at the base station 109). In addition, 
the wireless access communication unit 106 detects off-hook 
transitions from the CPE 105, and initiates call release 
procedures towards the network in response to an off-hook 
transition. When a call is completed, the wireless access 
communication unit 106 provides landline -transparent con- 
trol of disconnect procedures for clearing initiated by the 
CPE 105. As part of this function, the wireless access 
communication unit 106 implements the release guard times 
supported by conventional wireline systems. 

[0049] In addition to the above functions, the wireless 
access communication unit 106 also supports the signaling 
of DTMF digits during an active call. As part of this 
function, the wireless access communication unit 106 
detects DTMF tones from the CPE 105 during an active call 
and relays the digits to the network via DTAP signaling. 
Also during a call, the wireless access communication unit 
106 may pass call progress tones received from the network 
transparently over the bearer path to the CPE 105. Whenever 
call progress DTAP signaling is received from the network, 
the wireless access communication unit 106 converts the call 
progress DTAP signals into call progress tones towards the 
CPE 105. The wireless access communication unit 106 may 
generate reorder tones to the CPE 105 when needed, so as 
to indicate congestion of the wireless network or permanent 
signal timer expiry conditions to the CPE 105. 

[0050] Additionally the wireless access communication 
unit 106 also preferably performs a number of functions 
related to bearer processing. For example, in a preferred 
embodiment the wireless access communication unit 106 
performs vocoding for voice communication. In this regard 
vocoding includes encoding/compression of speech towards 
the network and decoding/de-compression of speech in the 
reverse direction (i.e., towards the CPE 105). The wireless 
access communication unit 106 also preferably performs 
forward error correction (FEC), encryption and decryption 
for the bearer voice (with the wireless access communica- 
tion unit 106 and transcoding unit 115 being peer-to-peer 
endpoints for ciphering) and echo cancellation functions. 
For encryption and decryption, the wireless access commu- 
nication unit 106 encrypts the bearer data prior to transmis- 
sion over the air (i.e. over the wireless trunk 108), and 
decrypts bearer data received from the network. Echo can- 
cellation functions are supported by the wireless access 
communication unit 106 so as to suppress the echo poten- 
tially generated towards the wireless network if, for 
example, a 2-4 wire hybrid structure is present at the 
interface with the CPE 105. 
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[0051] In a preferred embodiment, the wireless access 
communication unit 106 in conjunction with the wireless 
system supports management and security features such as 
call registration, de-registration, user authentication, cipher- 
ing of bearer information, and network management func- 
tions. In addition to providing a means for outgoing voice 
calls, the wireless access communication unit 106 may also 
support outgoing emergency (i.e., "911") calls and end-to- 
end DTMF signaling during active calls. 

[0052] Details of a preferred wireless access communica- 
tion unit 201 are depicted in FIG. 2, and of a preferred 
software structure for the wireless access communication 
unit 201 in FIG. 3. As shown in FIG. 2, the wireless access 
communication unit 201 comprises a plurality of subscriber 
ports 203, which are provided for connecting the CPE 105 
(see FIG, 1) to the wireless access communication unit 201 
across a trunk interface (e.g., trunk interface 104 shown in 
FIG. 1). Each subscriber port 203 can support one call 
connection over the wireless access communication unit 
201, and may comprise, for example, an RJ-11 interface. 
While four subscriber ports 203 are shown in FIG. 2, it will 
be understood that the number of subscriber ports 203 may 
vary depending upon the particular application or environ- 
ment in which the wireless access communication unit 201 
is deployed. For example, the wireless access communica- 
tion unit 201 may be configured with only a single sub- 
scriber port 203, or may have any number of subscriber ports 
203 limited only by practical considerations such as the 
number of wireless communication channels generally 
accessible and available to the wireless communication unit 
201. Also, the subscriber ports 203 may comprise any 
suitable interface, with an RJ-11 interface being but one 
example of such an interface. 

[0053] Each subscriber port 203 is connected to an indi- 
vidual line interface unit or line card section 205. Thus, the 
wireless access communication unit 201 comprises four line 
card sections 205, one for each subscriber port 203. The line 
card section 205 provides a physical subscriber line interface 
from the CPE 105 to the wireless access communication unit 
201, and in addition provides digitizing and data compres- 
sion functions. 

[0054] Details of one of the multiple line card sections 205 
are shown in FIG. 2, with the other line card sections 205 
being configured in a similar fashion. The line card section 
205 comprises a subscriber interface 207 which is connected 
to one of the subscriber ports 203. The subscriber interface 
207 comprises a subscriber line interface circuit (SLIC) 217, 
which provides conventional loop interface functions 
including battery feed, overload protection, supervision, and 
2-4 wire hybrid. Both loop-start and ground-start signaling 
are preferably supported by the line card section 205. The 
selection between loop -start and ground-start signaling may 
be made, for example, by use of a manual toggle switch or 
dip switch (not shown) located on the wireless access 
communication unit 201, each line card section 205 may be 
individually configured to interface with a loop-start or 
ground-start trunk. The subscriber interface 207 further 
comprises a standard CODEC or, alternatively, a subscriber 
line audio processing circuit (SLAC) 215 which carries out 
analog-to-digital and digital-to-analog conversion between 
the line card section 205 and the user station (e.g., telephone 
station 102 shown in FIG. 1) connected to the subscriber 
port 203. The CODEC or SLAC 215 provides a standard 


//-law pulse code modulation (PCM) interface. The sub- 
scriber interface 207 also comprises a ring generator 216 for 
generating a ringback tone. 

[0055] A digitized data stream is output from the CODEC 
or SLAC 215 and provided across signal line(s) 214 to a 
vocoder 206, which compresses the digitized data stream 
into a compressed data signal. The vocoder 206 comprises a 
relatively high-speed digital signal processor 211 (operating 
at, e.g., a rate of twenty million instructions per second or 
other suitable rate), along with support modules such as a 
high-speed static random-access memory (SRAM) 212 and 
an EPROM 213. The vocoder 206 preferably provides, as 
part of its decoding function, an interpolation capability for 
deriving predicted speech patterns, so as to handle situations 
where, for example, the wireless access communication unit 
201 detects data frames that contain errors, or else the data 
frames contain errors that cannot be corrected by forward 
error correction (FEC). The decoding function of the 
vocoder 206 also preferably provides a mute capability for 
silencing the output to the CPE 105 when beneficial to do so. 
such as during control traffic exchanges. The vocoder 206 
outputs a compressed data signal at a rate of, e.g., 8 Kbps, 
which is sent to a control line card assembly (LCA) 226 
located in a control section 220. Control section 220 thereby 
receives four compressed data signals, one from each of the 
line card sections 205. 

[0056] Each line card section 205 also hosts a subscriber 
interface module (SIM) 208. The general functions of the 
SIM 208 are to provide system security and store subscriber- 
specific information, including such things as subscriber 
authentication information and subscriber-specific data. In a 
preferred embodiment, the SIM function is duplicated for 
each CPE trunk supported by the wireless access commu- 
nication unit 201, as each CPE trunk may be viewed as a 
different subscriber by the network. This duplication may be 
explained with reference to FIG. 6. In FIG. 6, a plurality of 
CPE trunks 602 are shown connected to the wireless access 
communication unit 605 (each CPE trunk 602 being con- 
nected to a subscriber port 203 shown in the more detailed 
diagram of FIG. 2). A separate SIM 606 is associated with 
each of the CPE trunks 602. Thus, for four CPE trunks 602, 
the wireless access communication unit 605 comprises four 
SIMs 606. The wireless access communication unit 605 
further comprises a plurality of radio interface units 607, one 
for each of CPE trunk 602, for the purpose of passing data 
and other information to the wireless transceiver (not 
shown) which handles the physical wireless communication 
links 609. 

[0057] Generally, each subscriber within the communica- 
tion system requires unique identification and possibly dif- 
ferent system parameters. To the extent that the multiple 
CPE trunks (corresponding to the multiple subscriber ports 
203 shown in FIG. 2) are viewed by the system as individual 
and unique subscribers each CPE trunk is associated with a 
unique identifier and, preferably, unique authentication and 
other system parameters, which are implemented at least in 
part with the separate SIM 208 used in each line card 205. 
Thus, for four CPE trunks (corresponding to the four sub- 
scriber ports 203 shown in FIG. 2), four copies of the SIM 
208 are used in the wireless access communication unit 201. 

[0058] The functionality of the SIM 208 may be imple- 
mented as one or more non-removable SIM chips within the 
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wireless access communication unit hardware architecture. 
The SIM 208 stores within a non-volatile memory (such as 
a ROM, or non-volatile RAM) subscriber information such 
as a subscriber identifier. In a preferred embodiment, the 
subscriber identifier comprises an international mobile sub- 
scriber identity (IMSI) number. In addition to storing the 
subscriber identifier, the SIM 208 also runs an authentication 
procedure such as. for example, an "A3" and/or "A8" 
authentication procedure conventionally used in certain 
GSM applications. The details of preferred authentication 
procedures are described later herein. 

[0059] The control section 220 of the wireless access 
communication unit 201 provides timing and control for 
virtually all aspects of the wireless access communication 
unit 201. The control section 220 comprises a processor 225 
which may comprise, for example, a 16-bit RISC processor 
(such as a CI 65 or CI 63 processor manufactured by 
Siemens Corp.) and associated support modules (i.e., 
SRAM, flash memory, etc.). Access to the SIM 208 is 
initiated by the host processor 225 and controlled and 
formatted by the control line card assembly (LCA) in the 
control section 220. The processor 225 also coordinates 
most system activities and moves data between the various 
modules. 

[0060] The processor 225 is connected to the control LCA 
226 which, as noted above, is connected to the vocoder 206 
from each of the line card sections 205. The control LCA 
226 is also connected to a radio interface line card assembly 
(RIF LCA) 227. The control LCA 226 provides the interface 
between the radio section and the line card section of the 
wireless access communication unit 201. The control LCA 
226 packages and formats data, and coordinates and coatrols 
the over-the-air (OTA) protocol. It thereby maintains coor- 
dination between up to four compressed serial data streams 
(one from each of the line card sections 205) and their 
respective over-the-air communication channels. 

[0061] The radio interface LCA 227 is connected to a 
baseband processor 228, which may include a digital radio 
ASIC (DRA) 229. The baseband processor 228 is connected 
to a radio section 240. The radio section 240 preferably 
comprises a plurality of antennas 243 which are selectable 
by a selector 242 which is connected to the control LCA 22 6. 
Signals from one or more antennas 243 are thereby provided 
to a radio transceiver 241 (possibly including multiple radio 
receivers, one for each antenna 243). In a preferred embodi- 
ment, antenna diversity techniques are utilized such that the 
wireless access communication unit 201 selects the best 
antenna (and/or radio receiver) for each frame of time in 
which it communicates. Various antenna selection tech- 
niques are known in the art, or are described in, for example. 
U.S. patent application Ser. No. 08/826,773 filed Apr. 7, 
1997, hereby incorporated by reference as if set forth fully 
herein. 

[0062] The wireless access communication unit 201 may 
be powered either through an external DC power supply 250 
or an on-board battery 251. The battery 251 may be used as 
a reserve power supply, being brought into service auto- 
matically if the external DC supply 250 is cutoff or other- 
wise unavailable. A power section 221 for the wireless 
access communication unit 201 may comprise local voltage 
regulators to supply required power to the logic and radio 
sections, and a switching regulator to supply any requisite 
loop battery voltage. 


[0063] The wireless access communication unit 201 may 
be provided with an LED 231 or other visual display 
mechanism(s) to indicate the status of the device to an 
observer. The types of status conditions to be displayed may 
include, for example, whether the power is on, whether the 
device is functional (i.e., all self tests have been passed), or 
whether the device is in service (i.e., is currently registered 
with a base station). 

[0064] In operation, compressed serial data is transferred 
to and from the multiple line cards 205 under the direction 
of the control LCA 226. The control LCA 226 places the 
compressed serial data in a format suitable for the radio 
interface LCA 227. It also performs any desired encryption 
or adds forward error correction information. The control 
LCA 226 transfers the data to the radio interface LCA 227 
which passes the data to the baseband processor 228. The 
radio interface LCA 227 keeps track of channel and timing 
information, and instructs the baseband processor 228 to 
process the data according to the channel and timing param- 
eters. In a preferred embodiment, the baseband processor 
228 comprises a transmitter for formulating continuous 
phase modulated spread-spectrum signals, or other types of 
quadrature or related signals, as described, for example, with 
respect to transmitters shown in U.S. Pat. Nos. 5,629,956, 
5,610,940 or 5,548,253, all of which are hereby incorporated 
herein by reference as if set forth fully herein. At the 
appropriate time intervals, as determined by the radio inter- 
face LCA 227, the baseband processor 228 sends the data to 
the radio section 240 which converts the signal to the 
appropriate transmission frequency and performs any nec- 
essary filtering for transmission over the air. The frequency 
band utilized by the wireless access communication unit 106 
is generally dictated by the overall communication system 
within which the unit is deployed. For example, the fre- 
quency band may be within the PCS frequency band of 1930 
MHz to 1990 MHz, or may be any other suitable frequency 
band or bands. 

[0065] Incoming message signals are received by one or 
more of antennas 243 and sent to the radio transceiver 241 
for downconversion and/or filtering as needed. The down- 
converted and/or filtered data is then sent to the baseband 
processor 228 which demodulates the received signal. In a 
preferred embodiment, the wireless access communication 
unit 201 transmits and receives messages using a spread 
spectrum format. In such an embodiment, the baseband 
processor 228 preferably comprises a spread spectrum cor- 
relator. A wide variety of spread spectrum correlators are 
known in the art, examples of which include embodiments 
illustrated or described in U.S. Pat. Nos. 5,629,956, 5,610, 
940, 5,396,515 or 5,499,265, each of which is hereby 
incorporated by reference as if set forth fully herein. 

[0066] The baseband processor 228 outputs, among other 
things, a received signal strength indicator (RSSI), which is 
used by the control LCA 226 in selecting the best antenna 
243 (and/or radio receiver) for reception of the incoming 
signal. After spread spectrum correlation, the baseband 
processor 228 provides a stream of data bits to the radio 
interface LCA 227, which transfers the data to the appro- 
priate line card 205 based upon the over-the-air communi- 
cation channel over which the data was received. The data 
is then processed by the line card 205 and sent to the CPE 
105 via the particular subscriber port 203 connected to the 
line card 205. 
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[0067] A diagram of a preferred software structure for the 
wireless access communication unit 201 is shown in FIG. 3. 
As shown in FIG. 3, the software of the wireless access 
communication unit 201 is functionally divided into two 
main components, based on the physical interfaces sup- 
ported by the wireless access communication unit 201. 
These two main components are referred to in FIG. 3 as the 
line manager 350 and the over-the-air manager 351. 

[0068] The line manager 350 generally handles the CPE 
trunk management and communication between the wireless 
access communication unit 201 and the CPE 105. In addition 
to CPE trunk management and communication interface 
functions, the line manager 350 is also responsible for call 
signaling, DTMF recognition, and transfer of collected 
DTMF digits to the over-the-air manager 351. The line 
manager 350 comprises a plurality of line drivers 303 and a 
plurality of SIM drivers 304, one line driver 303 and one 
SIM driver 304 for each CPE trunk supported by the 
wireless access communication unit 201. A single line driver 
303 and SIM driver 304 collectively comprise a CPE line 
software component 302. 

[0069] The over-the-air manager 351 handles the commu- 
nication interface and link management to the base station 
109 (see FIG. 1). The over-the-air line manager 351 is also 
responsible for receiving DTMF digits from the CPE 105 
(via the line manager 350) and relaying the DTMF digits to 
the base station 109 (which ultimately conveys them to the 
PSTN 125), as set forth in more detail copending U.S. patent 

application Ser. No. (attorney docket 228/123), 

previously incorporated herein by reference. The over-the- 
air line manager 351 also implements the over-the-air com- 
munication protocol, including end-to-end communication 
with various network entities such as the base station 
controller 112 and mobile switching center 116 (shown in 
FIG. 1). Exemplary over-the-air communication protocols 
that may be implemented by the over-the-air manager 351 
include, for example, the GSM direct application transfer 
part (DTAP) protocol, or the IS-661 over-the-air ("O- 
Notes") protocol as described in the OMNI_Notes_RMT 
Protocols Rev. 02.03D (release date Juo. 30, 1997), appear- 
ing as a Technical Appendix A filed herewith, and hereby 
incorporated by reference as if set forth fully herein. At the 
physical radio level, the over-the-air manager 351 of the 
wireless access communication unit 201 preferably imple- 
ments the IS-661 protocol as set forth in the above-refer- 
enced OMNl_Notes_RMT Protocols publication, or a varia- 
tion thereof. 

[0070] As further illustrated in FIG. 3, the over-the-air 
manager 351 comprises a plurality of CPE line link objects 
310, one for each CPE trunk (i.e., subscriber port 203) 
supported by the wireless access communication unit 201. 
Each CPE line link object 310 provides the signaling 
resource for a single CPE line or trunk, and comprises 
several components which together form a signaling proto- 
col stack. The components of the signaling protocol stack 
work together to interface with a CPE line to provide call 
management, mobility management and radio resource 
functionality required to complete a voice call, and the 
registration functionality required to utilize network 
resources. 

[0071] Each CPE line link object 310 comprises a CPE 
line manager 311, the purpose of which is to interface with 


the CPE line software component 302 for the appropriate 
CPE line or trunk. In a preferred embodiment, the CPE line 
manager interfaces with a GSM call management compo- 
nent 312 and a GSM call registration component 313, both 
of which interface with a GSM mobility management com- 
ponent 314. The GSM mobility management component 

314 interfaces with a protocol adaption (PAL) component 
315, which interfaces with an over-the-air state (OTA) 
machine 316. The OTA state machine 316 is generally 
responsible for managing the physical radio interface, and 
communicates with the radio transmit/receiver interface and 
slot management (RTRX) component 321. 

[0072] In operation, the CPE line manager 311 signals the 
GSM mobility management component 314 to initiate con- 
nection establishment procedures, as described in more 
detail hereinafter with respect to the call flow diagrams 
appearing in FIGS. 13 through 22. The CPE line manager 
311 also controls transmission of DTMF digits to the net- 
work, the enabling of the speech path, generation of ring- 
back tones, generation of a busy tone (in non-PSTN inter- 
working situations), and passing of on- hook indication to the 
CPE 105. In addition, the CPE line manager 311 manages 
CPE-initiated call clearing as well as normal and emergency 
call procedures. 

[0073] The GSM call management component 312, GSM 
registration component 313, and GSM mobility manage- 
ment component 314 provide a degree of GSM functionality 
relating to call management, registration, and mobility man- 
agement, respectively. The protocol adaption component 

315 adapts, if necessary, the GSM signaling protocol to the 
over-the-air protocol (such as, for example, to the IS-661 
over-the-air protocol). The OTA state machine 316 imple- 
ments the over-the-air protocol and, as noted, manages the 
physical radio interface. 

[0074] In addition to the multiple CPE line link objects 
310, the OTA manager 351 further comprises a hardware 
services component 320 which provides a programming 
interface to the hardware (including hardware controlled by 
the line drivers 303 and SIM drivers 304) of the wireless 
access communication unit 201. The OTA manager 351 may 
comprise a real-time operating system (RTOS) 330, which 
may be a multi -tasking operating system, as well as a 
power-on/reset initialization (POST) component 323 and a 
debug port manager 322. The debug port manager 322, if 
provided, allows access externally to the internal status of 
the software, and also permits software downloads. 

[0075] In addition to the above-described components, the 
OTA manager 351 also comprises an operations, adminis- 
tration and management (OAM) component 324. The OAM 
component runs at the application level, and performs such 
functions as recognition of faults, creating and sending 
alarms, and communicating with the line manager 350 for 
call processing data needed in fault detection and alarms. 
The types of faults or failures monitored may include for 
example, hardware failures (such as power supply failures, 
radio unit failures, line card failures, and so on), software 
failures, communication failures, and quality of service 
failures (e.g., unsuccessful call attempts per time period, 
time slot interchange requests per time period, unsuccessful 
time slot interchanges per time period, number of dropped 
calls per time period, channel quality as indicated by bit 
error rate, and so on), among others. Fault reporting may be 
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coordinated such that a single fault that causes multiple 
failures due to the dependency of the software, hardware and 
telecom functions will result in a single fault being reported. 

[0076] In one aspect, the functionality of the over-the-air 
manager 351 used to support the wireless access communi- 
cation unit 201 may be viewed as a subset or modification 
of the functionality that would be used to support a mobile 
user application. For example, the mobility management 
interface (MMI) software component used in a conventional 
GSM system to support a mobile user is, in the software 
architecture shown in FIG. 3, replaced with a CPE line 
manager 311. Another difference over a mobile user appli- 
cation is that a logical instance of the signaling protocol 
stack is provided for each CPE line connected to the wireless 
access communication unit 201 (as opposed to having a 
single logical instance of the signaling protocol stack for a 
mobile user application), and the SIM driver is modified 
offer a mobile user application to accommodate multiple 
SIMs (or their logical equivalents) by, for example, the 
provision of multiple independent SIM drivers 304. Further, 
an ability is added to associate a hardware voice path from 
the CPE 105 with a base station communication link. The 
signaling protocol may also be modified, as further 
described herein, to support digit analysis by the base station 
109 (see FIG. 1). DSAT and DTA adaptor software com- 
ponents conventionally used in certain mobile user applica- 
tions are not needed by the wireless access communication 
unit 201, and are therefore not implemented. 

[0077] Referring back to FIG. 1, the wireless access 
communication unit 106 interfaces with a base station 109 of 
the wireless system to achieve access to the PSTN 125. A 
block diagram a preferred base station 401 is shown in FIG. 
4. The base station 401 comprises a number of separate 
components connected together by a common global bus 
backplane, as illustrated in FIG. 4. These components 
include a digital line card 404, an over-the-air (OTA) pro- 
cessor card 405, a power supply module 407, and a plurality 
of radio cards 406, all of which reside on an electronics 
module 420. The electronics module 420 is connected to an 
I/O module 421, which comprises protection circuitry 403 to 
prevent such things as damage from short circuits. Each 
radio card 406 is connected, via the protection circuitry 403, 
to one of a plurality of antennas 403. The digital line card 
404 is connected, via protection circuitry 403, to the PSTN 
125 (through base station controller 112 and MSC 116, as 
shown in FIG. 1) over a backhaul line 430, and possibly to 
other base stations 109 as well over other physical connec- 
tions. The base station 401 may be connected to a local AC 
power supply line 425, if available. 

[0078] In operation the wireless access communication 
unit (identified by reference numeral 412 in FIG. 4) trans- 
mits over-the-air messages to and receives over-the-air mes- 
sages from the base station 401. The multiple antennas 411 
and radio cards 406 are used at the base station 401 for 
achieving antenna diversity. Typically one antenna 411 is 
selected at a given time for transmitting or receiving over- 
the-air signals. If spread spectrum communication is being 
used, then the OTA processor card 405 may comprise a 
spread spectrum correlator and other baseband processing 
circuitry for correlating a spread spectrum signal received 
from the wireless access communication unit 412 and con- 
verting it to data bits. The OTA processor card 405 transfers 
data to the digital line card 404, which formats the data and 


sends it over a backhaul to the PSTN 125 via the other 
intervening system components (such as the base station 
controller 112 and MSC 116). Similarly, the digital line card 
404 receives data from the PSTN 125, and transfers the data 
to the OTA processor card 405 which formats the data for the 
over-the-air protocol and transmits the formatted data using 
a selected radio card 406 and antenna 411. 

[0079] The primary functions of the radio cards 406 are to 
transmit and receive RF data packs, to perform packet data 
integrity services (e.g., cyclic redundancy checks), and to 
support antenna diversity algorithms. The primary function 
of the OTS processor card 405 is to move bearer data 
between the radio cards 406 and the digital line card 404. 
The OTA processor card 405 also executes operations, 
administration, management and provisioning (OAM&P) 
requests from the digital line card 404, communicates sig- 
naling information (using internal base station messages or 
"I-Notes") with the digital line card 404, and communicates 
signaling information (using over-the-air signaling mes- 
sages or "O-Notes") with the wireless access communica- 
tion unit 412. Various types of signaling information and 
formats therefor (including I-Notes and O-Notes) that may 
be transmitted across or within the base station 401 or other 
system components are described in, for example, copend- 
ing U.S. patent application Ser. No. 08/532,466 filed Sep. 
22, 1995, hereby incorporated by reference as if set forth 
fully herein. 

[0080] The primary functions of the digital line card 404 
are to handle link access procedures for the "D-channel" 
(LAPD) transport on the backhaul line 430, to exchange 
bearer data between the OTA processor card 405 and the 
network-side backhaul components (such as the base station 
controller 112), and to multiplex and demultiplex bearer data 
on the backhaul line 430. Other primary functions of the 
digital line card 404 include synchronizing the over-the-air 
bearer frame timing with the timing on the backhaul line 430 
(such as a Tl line), to provide translation between the 
OAM&P procedures supported on the network and radio 
interfaces, to map internal base station messages (e.g., 
I-Notes) to/from the LAPD transport on the backhaul, and to 
communicate signaling information (using, e.g., signaling 
I-Notes) with the OTA processor card 405. 

[0081] A preferred high level software architecture for the 
base station 401 is depicted in FIG. 5. According to the 
software architecture shown in FIG. 5, the software of the 
base station 401 is split into two functional groups, one 
functional group relating to the over-the-air functions and 
the other functional group relating to the line card functions. 
These trio main functional groups are shown in FIG. 5 as the 
OTA manager 502 and the line card manager 503, each of 
which preferably runs on its own processor board. Further 
information regarding the software architecture for the base 
station 401 may be found in the copending patent applica- 
tions previously incorporated herein by reference. 

[0082] Various interfaces associated with the base station 
401 are shown diagrammatically in FIG. 5 as dotted lines, 
and include an over-the-air interface or "O-interface"560 
between the wireless access communication unit 412 and the 
base station 401, an internal interface or "I-interface"561 
between the OTA manager 502 and the line card manager 
503, and a network interface or "N-interface"562 between 
the base station 401 and the network-side backhaul compo- 
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nents (such as the base station controller 112, MSC 116, and 
PSTN 125 shown in FIG. 1). Further information regarding 
these interfaces may be found in copending U.S. patent 
application Ser. No. 08/532,466, previously incorporated 
herein by reference, or in copending U.S. patent application 

Ser. No. (attorney docket 228/118) and (attorney 

docket 228/119), previously incorporated herein by refer- 
ence. These interfaces are also shown at an abstract level in 
FIG. 10, described later herein. 

[0083] In operation, the base station 401 manages the 
radio resources for the wireless access communication unit 
412, and thereby provides support for the network side of the 
wireless trunk 108 (see FIG. 1). A wide variety of different 
communication schemes and radio resource protocols may 
be used. If, for example, the base station 401 implements an 
IS-661 protocol for over-the-air communication, then the 
base station 401 manages the resources necessary to support 
the wireless communication channels between the wireless 
access communication unit 412 and the base station 401, 
including time slots and spread spectrum codes. The base 
station 401 also provides multiplexing functions for the 
transfer of data to and from the backhaul line 430 providing 
the connection to the PSTN 125. The base station 401 may, 
for example, multiplex data over a Tl (or fractional Tl) 
backhaul line 430 to the base station controller 112, which, 
as noted, pipes the data to and from the PSTN 125 via the 
MSC 116. 

[0084] Protocol signaling over the N-Interface 562, which 
connects the base station 401 (or 109 in FIG. 1) to the base 
station controller 112 (see FIG. 1), may be transported using 
the Q.921 LAPD protocol. Protocol signaling over the 
O -Interface 560, which connects the base station 401 to the 
wireless access communication unit 412, may be accom- 
plished using over-the-air signaling messages ("O -Notes") 
according to the IS-661 protocol. The O-Notes may be 
transmitted along with bearer data in IS-661 RF packets. 

[0085] The base station 401 connects and manages radio 
and terrestrial bearer channels for call-related features, and 
supports system administration via OAM&P controlled by 
the system operator through the operations management 
center 120 (see FIG. 1). As part of its radio resource 
management functionality, the base station 401 supports 
outgoing voice calls (normal and emergency) from the 
wireless access communication unit 412. Incoming pages to 
the wireless access communication unit 412 may optionally 
be supported by the base station 401. 

[0086] Among its other radio resource management func- 
tions, the base station 401 manages mapping of the radio 
channels (including the wireless communication channels of 
the wireless trunk 108) to the terrestrial (i.e., backhaul) 
channels. The base station 401 also provides, through its 
OAM&P functionality, support for administrative state 
changes, configuration, and provisioning of the radio 
resources. The base station 401 also provides fault manage- 
ment and alarm management for the radio resources, and 
sends fault or alarm signals to the base station controller 112. 
In addition, the base station 401 provides signaling flow 
control across the over-the-air interface, power control man- 
agement for each radio channel radio link recovery upon 
radio link interruption, and debug information logs to the 
base station controller 112 As part of its power control 
management for the various radio channels, the base station 


401 may send performance metrics relating to the radio 
resources to the base station controller 112 for analysis. 

[0087] In terms of call control support, the base station 
401 is involved in establishing, maintaining and tearing 
down outgoing voice calls received from the wireless access 
communication unit 412. The base station 401 provides digit 
analysis for outgoing telephone calls, and relays DTMF 
signaling from the end user to the PSTN 125, if necessary, 
during an active telephone call. This signaling is relayed 
transparently through the base station 401, and is supported 
by the I-interface and N-interface transport procedures. 

[0088] The base station 401 also preferably provides secu- 
rity support in various manners. The base station 401 may, 
for example, provide support for bearer ciphering that occurs 
at the transcoding unit 115 and the wireless access commu- 
nication unit 106. The base station 401 may also support the 
GSM temporary mobile subscriber identity (TMSI) for 
protection of the user identity. 

[0089] Referring again to FIG. 1, aspects of the base 
station controller 112 will now be described. As shown in 
FIG. 1, the base station 109 is connected to the base station 
controller 112 over an interface such as an N-interface (such 
as the N-interface 562 described previously with respect to 
FIG. 5). Data (including signaling messages and bearer 
traffic) are passed between the base station 109 and the base 
station controller 112 across the N-interface. 
[0090] A preferred base station controller 112 may be 
viewed in one aspect as a base station subsystem controller 
that is used for managing one or more base stations 109. A 
primary responsibility of the base station controller 112 is to 
provide an interface between the MSC 116 and the radio 
access subsystem (i.e., the system components responsible 
for establishing and maintaining the physical radio chan- 
nels). In a preferred embodiment, the base station controller 
112 incorporates aspects of the IS-661 communication pro- 
tocol and the GSM communication protocol, thereby using 
what may be referred to as a "hybrid" protocol. Details of a 
preferred communication protocol may be found in, for 

example, copending U.S. patent application Ser. No. 

(attorney docket 228/118) and Ser. No. (attorney 

docket 228/119), previously incorporated herein by refer- 
ence. In an alternative embodiments, the base station con- 
troller 112 may be implemented using the IS-661 protocol in 
its entirety, or the GSM communication protocol in its 
entirety. 

[0091] In a communication system using a "hybrid" pro- 
tocol having aspects of both IS-661 and GSM protocols, the 
base station controller 112 preferably performs a variety of 
resource management functions. As part of these functions, 
the base station controller 112 switches bearer circuits and 
provision of bearer connectivity to form a path from the base 
stations 109 to the MSC 116 for outgoing voice calls from 
the wireless access communication unit 106. In addition to 
switching bearer circuits, the base station controller 112 
provides signaling paths from the wireless access commu- 
nication unit 106 to the MSC 116 and other network ele- 
ments. If required, the base station controller 112 carries out 
the interworking between the BSSMAP radio resource man- 
agement procedures on the GSM A-interface and the 
"N-Notes" radio resource management procedures on the 
N-interface. 

[0092] The base station controller 112 is involved in the 
allocation and release of radio channels. If the IS-661 
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protocol is used, then the base station 109 is the entity that 
actually assigns and releases over-the-air resources. As part 
of call setup, however, the base station controller 112 is the 
entity that coordinates this process. The base station con- 
troller 112 also controls the allocation and release of back- 
haul channels. If the IS-661 protocol is used, then the base 
station 109 is the entity that actually assigns the bearer 
resources over the backhaul channels. However, as part of 
call setup, the base station controller 112 coordinates this 
process as well. 

[0093] The base station controller 112 is also involved in 
ciphering of transmitted data. While the Transcoding unit 
115 (see FIG. 1) is preferably the network end-point for 
bearer ciphering, the base station controller 112 sets up and 
coordinates ciphering of bearer messages. 

[0094] Certain mobility management procedures, such as 
authentication and identification, run end-to-end between 
the wireless access communication unit 106 and the MSC 
116, and are relayed through the base station controller 112 
with essentially no interworking requirements. For other 
mobility management functions, the base station controller 
112 performs interworking between the N-interface and 
A- interface procedures. For example, the base station con- 
troller 112 may perform interworking between the N-inter- 
face and A-interface procedures for location updating or 
network-level registration (both normal and periodic, as 
further described herein), de-registration or IMSI detach, 
time slot interchange reallocation, and mobility management 
connection establishment. 

[0095] Call control messages and procedures run end-to- 
end between the wireless access communication unit 106 
and the MSC 116, and are relayed transparently through the 
base station controller 112. In one aspect, the base station 
controller 112 provides a signaling path between the wire- 
less access communication unit 106 and the MSC 116 to 
carry out call control signaling. 

[0096] The base station controller 112 may support a 
variety of interfaces. The base station controller 112 pref- 
erably supports the T-interface to the transcoding unit 115 or, 
if the transcoding unit functionality is consolidated with the 
base station controller 112, a GSM A-interface between the 
consolidated base station controller/transcoding unit and the 
MSC 116. In the other direction, the base station controller 
112 also preferably supports the N-interface to the various 
base stations 109 to which it is connected. 

[0097] In a preferred embodiment, the base station con- 
troller 112 transmits and receives information to the 
transcoding unit 115, shown in FIG. 1. The transcoding unit 
115 in one aspect comprises a base station subsystem (BSS) 
entity located, in one embodiment, between the base station 
controller 112 and the MSC 116. Preferably, the transcoding 
unit 115 is under management control of the base station 
controller 112, but is physically located on the premises of 
the MSC 116, thereby allowing the base station controller 
112 to be remotely located from the site of the MSC 116. The 
transcoding unit 115 comprises a number of transcoding unit 
shelves, operating independently of one another but under 
the control of the base station controller 112. In a preferred 
embodiment, each transcoding unit shelf supports up to 92 
bearer channels. 

[0098] The transcoding unit 115 generally provides the 
network side processing of key functions on the bearer path. 


This processing may include, for example, speech transcod- 
ing, network-side forward error correction (FEC), and net- 
work-side enciphering and deciphering of bearer voice. 

[0099] With respect to the speech transcoding function, 
the transcoding unit 115 preferably provides bidirectional 
conversion between encoded voice data received from the 
user side, and "mu-law" coded pulse-code modulated 
(PCM) data received from the network side at 64 kilobits per 
second. The vocoder 206 in the wireless access communi- 
cation unit 106 (see FIG. 2) compresses speech received 
from the CPE 100 for over-the-air transmission towards the 
network. In the reverse direction, the vocoder 206 in the 
wireless access communication unit 106 de-compresses 
over-the-air speech prior to transmission to the CPE 105. 

[0100] The transcoding unit 115 preferably comprises, 
among other things, a speech encoder and speech decoder. 
The speech encoder in the transcoding unit 115 receives 
PCM speech data from the network delivered at 64 kilobits 
per second, and compresses this data into a sub-rate over- 
the-air channel for transmission towards the wireless access 
communication unit 106. Forward error correction (FEC) 
information is added separately at the transcoding unit 115 
by the FEC function. The speech decoder in the transcoding 
unit 115 processes compressed speech data from the wireless 
access communication unit 106, and transcodes this data to 
produce 64 kbit/s PCM speech data for transmission towards 
the MSC 116. The speech decoder in the transcoding unit 
115 additionally provides an interpolate function to output 
predicted speech patterns, in the event that the base station 
109 detects frames that contain errors that are not correct- 
able by the forward error correction function. The speech 
decoder in the transcoding unit 115 also provides a mute 
capability for silencing the output to the A-interface when 
necessary, such as during control traffic transmissions. 

[0101] With regard to forward error correction (FEC), in 
the user-to-network direction the FEC information is added 
on to messages by the wireless access communication unit 
106. The channel decoding function in the base station 
controller 112 and/or transcoding unit 115 uses the FEC 
information to detect the presence of errors, and to estimate 
the most probable emitted bits given the received ones. In 
the network-to-user direction, the base station controller 112 
and/or transcoding unit 115 applies forward error correction 
on the frames received from the vocoding function, before 
the frames are sent across the N-interface. The FEC decod- 
ing in the network-to-user direction is performed by the 
wireless access communication unit 106. 

[0102] With regard to encryption and decryption func- 
tions, a bearer encryption (or ciphering) mechanism utilized 
in the system is preferably based on the GSM A5/1 algo- 
rithm, which is an algorithm well known in the art. For 
bearer speech, the two endpoints in the system for encryp- 
tion and decryption are the wireless access communication 
unit 106 and the transcoding unit 115. Where communica- 
tion is divided into time frames and time slots (such as in 
certain types of time division multiple access or TDMA 
systems), encryption and decryption may be performed on a 
per-frame basis. 

[0103] The wireless access communication unit 106 and 
the transcoding unit 115 preferably are "encryption synchro- 
nized" in the sense that the frame number used by the 
wireless access communication unit 106 to encrypt a frame 
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is the same as the frame number used by the transcoding unit 

115 to decrypt, and vice versa. The GSM A5/1 algorithm 
involves the generation of encryption/decryption masks on a 
per- frame basis, based on the frame number. Typically, 
establishment or re-establishment of encryption synchroni- 
zation occurs at call setup and when recovering from loss of 
encryption synchronization due to error conditions (whether 
experienced in the over-the-air link or the backhaul link). 
Once the encryption synchronization is established (or re- 
established, as the case may be), the wireless access com- 
munication unit 106 and the transcoding unit 115 increment 
the frame number for each frame cycle on the over-the-air 
and backhaul interfaces. Preferably, the same frame length 
(e.g., 20 milliseconds) is used for both the over-the-air and 
the backhaul time frames, so incrementing the frame number 
each frame cycle normally maintains frame number syn- 
chronization between the two endpoints of the encryption/ 
decryption function. 

[0104] The transcoding unit 115 may support a variety of 
interfaces. The transcoding Unit 115 may support the A-in- 
terface linking the transcoding unit 115 at the MSC 116 and 
the T-interface linking the transcoding unit 115 to the base 
station controller 112. The T-interface carries bearer voice 
data that is processed by the transcoding unlit bearer func- 
tions and relayed on the A-interface to the MSC 116, as well 
as A-interface signaling over SS7 links. Preferably, the 
transcoding unit 115 provides transparent pass-through of 
signaling between the base station controller 112 and MSC 

116 over SS7 links and, optionally, X.25 or similar type 
links. The T-interface also carries signaling for OAM&P 
control of the transcoding unit 115, and inband signaling 
between the transcoding unit 115 and the base station 
controller 112 for dynamic per-call control of the transcod- 
ing unit functions. Signaling exchanged between the 
transcoding unit 115 and the base station controller 112 is 
concentrated in a specific time slot (e.g., the first time slot of 
a time frame), and controlled through the level-2 link- access 
procedures for the D-channel (LAPD) protocol, 

[0105] FIG. 9 is a high level diagram illustrating a pre- 
ferred breakdown of bearer path functions performed at the 
wireless access communication unit 106, the base station 
109, and the base station controller 112 and/or transcoding 
unit 115. As shown in FIG. 9, the wireless access commu- 
nication unit bearer path functions 901 include voice encod- 
ing and decoding forward error correction (FEC), encryption 
and decryption, and tone generation The base station bearer 
path functions 902 include backhaul framing and channel 
multiplexing and demultiplexing. The base station controller 
and transcoding unit bearer path functions 903 comprise 
voice encoding and decoding, forward error correction 
(FEC), encryption and decryption, backhaul framing, and 
channel multiplexing and demultiplexing. These functions 
have been mentioned previously in relation to the various 
components of the system, and are further described in 
various levels of detail elsewhere herein or in materials 
incorporated by reference herein. 

[0106] As shown in FIG. 9, the speech encoding/decod- 
ing, encryption/decryption and FEC functions performed in 
the wireless access communication unit 106 are mirrored in 
the based station controller 112 and/or transcoding unit 115. 
The channel multiplexing/de-multiplexing and backhaul 


framing functions performed in the base station 109 are also 
mirrored by the base station controller 112 and/or transcod- 
ing unit 115. 

[0107] Referring again to FIG. 1, the transcoding unit 115 
is connected to the mobile switching center (MSC) 116, 
which is connected to the PSTN 125. The MSC 116 is a 
cellular switch that acts as an interface between the base 
station subsystem (BSS) and the PSTN 125, and acts as the 
gateway to the long-distance network. The MSC 116 has 
telephone exchange capabilities including call setup, routing 
selection, switching between incoming and outgoing chan- 
nels, control of communications, and release of connections. 
In addition, the MSC 116 performs its functions while taking 
into account mobility management aspects of the subscriber, 
including authentication, ciphering, radio resource manage- 
ment, and location register updating procedures. The MSC 
116 also allows the wireless access communication unit 106 
interworking to the PSTN 125. The MSC 116 may be part of 
a digital multiplex system (DMS) "super-node" based 
switching system, capable of providing the switching func- 
tions in a cellular network. Also, the visitor location register 
(VLR) is preferably co-located and integrated with the MSC 
116. 

[0108] The MSC 116 may support a variety of interfaces. 
The MSC 116 may support an A-interface providing linkage 
between the MSC 116 and the base station subsystem (BSS), 
particularly the base station controller 112 and the transcod- 
ing unit 115, and a PSTN interface which is used for 
connecting the MSC 116 to the PSTN 125 across which 
voice and circuit traffic is transmitted. The MSC 116 also 
may support a mobile application part (MAP) interface, 
which is a CCS7 application permitting mobility informa- 
tion to be transferred among network level components. In 
addition, the MSC 116 may support a billing center inter- 
face, which is used for connecting the MSC 116 to a 
downstream processor for downloading of billing events; an 
operations management center (OMC) interface, which is 
used to administer the MSC 116 and visitor location register 
(VLR); and a service center interface, which is used for 
connecting the service center function responsible for relay- 
ing and store-and-forwarding short messages to mobile 
stations. 

[0109] A variety of functions are preferably performed by 
the MSC 116. For example, the MSC 116 preferably authen- 
ticates subscribers and, if accessible to the system, mobile 
stations. The MSC 116 interfaces to the PSTN 125, and may 
interface to, for instance, public land mobile networks 
(PLMNs) or PCS-1900 networks. The MSC 116 also pro- 
vides terrestrial channel allocation, and call control and 
signaling support. In addition, the MSC 116 may perform 
echo cancellation towards the PSTN 125, handling and 
management of database information, charge recording, 
handling of subscriber registration and location manage- 
ment, and operation measurements. 

[0110] The MSC 116 is connected to a home location 
register (HLR) and authentication center (AuC), collectively 
shown as an integrated unit HLR/AuC 123 in FIG. 1. The 
HLR/AuC 123 may be built on a digital (e.g., DMS) 
super- node platform, and interconnect with various func- 
tional entities including the visitor location register, MSC, 
and mobile application part (MAP). The HLR component of 
the HLR/AuC 123 contains information about subscribers, 
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services assigned to the subscribers, the status of such 
services, and any further information required to support the 
operation of the services when active. The HLR responds to 
requests from the MSC 116 and/or VLR to provide or update 
subscriber data. The HLR communicates with the VLR to 
download subscriber data and to obtain call routing infor- 
mation for the mobile stations in the region covered by the 
VLR. 

[0111] The AuC component of the HLR/AuC 123 contains 
subscriber keys for use in authenticating attempts to access 
the network. The AuC component uses subscriber keys to 
generate authentication vectors, as further described herein, 
which are provided to the VLR via the HLR component. 

[0112] In a mobile system, such as a PCS 1900 mobile 
system, the information held by the HLR component of the 
HLR/AuC 123 allows mobile stations to be addressed by 
means of a unique number, regardless of geographic loca- 
tion, thus allowing mobile stations to roam freely within and 
between networks. In a system providing fixed access wire- 
less services in which a wireless access communication unit 
106 and related components are utilized, the HLR compo- 
nent contains information similar to that maintained for 
mobile stations in a completely mobile-based system. The 
HLR component of the HLR/AuC 123 contains information 
regarding the subscribers interfacing with the wireless 
access communication unit 106. As noted previously, the 
individual CPE trunks connected to the wireless access 
communication unit 106 (such as CPE trunks 602 shown in 
FIG. 6) may appear as individual subscribers (i.e., "mobile 
stations") to the HLR and VLR. Hence, each CPE trunk 
connected to the wireless access communication unit 106 
has its own (preferably unique) subscriber identity number. 
The subscriber identity number may, as noted previously, 
comprise an international mobile subscriber identity (IMS I), 
which is a unique, permanent identifier of a CPE trunk 
assigned at the time of manufacture of the CPE 105, or may 
comprise a mobile subscriber ISDN (MSISDN) number, 
which would be one of the public PSTN numbers assigned 
to the CPE 105. 

[0113] Because the wireless network is likely to be con- 
figured to service individual mobile subscribers as well as 
being capable of servicing the wireless access communica- 
tion unit 106. the wireless access communication unit 106 
may include functionality for keeping its non-mobile aspects 
transparent from the wireless network. For example, a 
mobile telephone subscriber may occasionally signal the 
wireless network to refresh the VLR on a regular basis. To 
keep the fixed wireless aspects of the system transparent to 
the wireless network, the wireless access communication 
unit 106 may periodically perform network-level registra- 
tion using., for example, a GSM periodic registration 
mechanism, to keep the VLR entries for the "subscribers" 
alive. The wireless access communication unit 106 may also 
perform network-level registration every time it registers 
through a base station 109 in a location area different from 
that of the base station 109 to which it was previously 
connected. Further details regarding initial and periodic 
registration may be found in, e.g., copending U.S. applica- 
tion Ser. No. (attorney docket 228/122) filed con- 
currently herewith, and previously incorporated herein by 
reference. 

[0114] Certain features relating to voice call establishment 
and maintenance will now be described in more detail, with 


reference to the interaction among various components of a 
communication system in which the wireless access com- 
munication unit 106 is deployed. 

[0115] For "outgoing" voice call establishment initiated 
by the CPE 105 the wireless access communication unit 106 
handles acquisition of an over-the-air communication chan- 
nel mobility management connectivity, and call setup, and in 
addition is preferably capable of handling various error or 
exception conditions. When the wireless access communi- 
cation Unit 106 detects a trunk seizure by the CPE 105, the 
wireless access communication unit 106 marks the CPE 
trunk as "busy" and issues a dial tone (assuming that it is 
able to communicate with a base station 109). In parallel, the 
wireless access communication unit initiates an over-the-air 
communication channel acquisition procedure. The dial tone 
is removed when the wireless access communication unit 
106 detects the first dialed digit from the CPE 105, or if it 
detects an on-hook from the CPE 105 prior to receiving any 
digits therefrom. 

[0116] To facilitate initial acquisition of over-the-air com- 
munication channels, upon initial power-up the wireless 
access communication unit 106 preferably performs a thor- 
ough search of nearby base stations 109 to find a suitable 
base station 109. The wireless access communication unit 
106 establishes communication with the base station 109, 
and receives a surrounding base station map from the current 
base station 109. The surrounding base station map provides 
the wireless access communication unit 106 with a list of 
neighboring base stations 109 that are candidates for over- 
the-air communication. Using the surrounding base station 
map, the wireless access communication unit 106 builds up 
a base station selection table containing such things as signal 
quality information on the neighboring base stations 109. 
The base station selection table is stored in non- volatile 
memory in the wireless access communication unit 106. On 
subsequent power-ons, the wireless access communication 
unit 106 uses the existing base station selection table to 
speed up its base station acquisition. 

[0117] On receiving a trigger from the CPE 105 to set up 
an outgoing call or perform a registration, the wireless 
access communication unit 106 attempts to acquire an 
over-the-air communication channel. In certain wireless 
systems the acquisition of an over-the-air communication 
channel is accomplished by interacting with a control chan- 
nel of the wireless system. In certain types of TDMA 
systems, the channel acquisition process may entail acquir- 
ing a time slot in a time frame established by the base station 
109. Acquisition of a time slot may be carried out, for 
example according to a handshake protocol described in 
more detail in U.S. Pat. No. 5,455,822, assigned to the 
assignee of the present invention, and hereby incorporated 
by reference as if set forth fully herein. 

[0118] In another aspect of the invention, each CPE trunk 
supported by the wireless access communication unit 106 
represents a logical subscriber to the network even though 
the multiple CPE trunks are physically connected to the 
wireless access communication unit 106. Thus, for example, 
where four CPE trunks are connected to the wireless access 
communication unit 106, four unique subscriber identifiers 
are allocated. The use of different logical subscriber identi- 
fiers for each CPE trunk permits multiple calls to be handled 
by the wireless access communication unit 106 across one or 
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more wireless links to the base station 109. In a particular 
embodiment, each CPE trunk is identified with its own 
unique international mobile subscriber identity (IMSI) num- 
ber and mobile station ISDN (MSISDN) number for 
addressing. When the wireless access communication unit 
106 initiates "mobility management" and call control pro- 
cedures on behalf of one of the connected CPE trunks, it uses 
the IMSI assigned to that CPE trunk. 

[0119] To the network side of the system (i.e., the base 
station 109, base station controller 112, MSC 116, etc.), each 
logical subscriber associated with the wireless access com- 
munication unit 106 is seen as a separate user, much like the 
separate mobile subscribers that can also communicate 
wirelessly with the base station 109. The base station 109 
Generally need not know that a group of different IMSIs 
belongs to a single entity (i.e. the wireless access commu- 
nication unit 106). The IMSIs are preferably held on one or 
more subscriber interface module (SIM) chips, programmed 
at the factory. Each SIM chip, once placed in the wireless 
access communication unit 106, belongs to a specific CPE 
trunk. The IMSI is used, as described elsewhere herein, for 
such things as registration, authentication, and network 
access. 

[0120] For each IMSI stored in the wireless access com- 
munication unit 106 there preferably is a corresponding 
MSISDN stored in the HLR component of the HLR/AuC 
123. Tile MSISDN number may be the equivalent of the 
NANP number converted into an MSISDN number — i.e., a 
number in the format of 1+NPA+NXX+XXXX. The 
MSISDN number is used for such thins as call origination 
and billing generation. The MSISDN number may be one of 
the public PSTN numbers assigned to the CPE 105; there- 
fore, the MSISDN number may be assigned to the CPE 105 
from the PSTN 125. 

[0121] The wireless access communication unit 106 may 
be assigned an identifying serial number in the form of an 
International Mobile Equipment Identity (IMEI) number. 
The IMEI number may be assigned at the factory, and each 
wireless access communication unit 1106 is preferably asso- 
ciated with a unique IMEI number. If an Equipment Identity 
Register (EIR) element is used within the network, it will 
contain the IMEI number of each wireless access commu- 
nication unit 106 in the system. Alarms generated by the 
wireless access communication unit 106 may use the IMEI 
number for identification purposes. 

[0122] FIG. 10 is a diagram showing interfaces between 
different components of a communication system 801 
according to a preferred embodiment of the present inven- 
tion. Some of these interfaces have been generally described 
previously with respect to the preferred base station 501 
shown in FIG. 5. The different interfaces shown in FIG. 10 
include an over-the-air interface or "O-interface"560 
between a wireless access communication unit 106 and the 
base station 109, an internal interface or "I-interface"561 
internal to the base station 109 (i.e. between the OTA 
manager 502 and the line card manager 503 of the preferred 
base station 501, as shown in FIG. 5), and a network 
interface or "N-interface"562 between the base station 109 
and the base station controller 112. The base station con- 
troller 112 communicates with the MSC 116 over a standard 
interface such as the GSM "A" interface. 
[0123] In a preferred embodiment, in accordance with the 
embodiment of the invention shown in FIG. 1, a transcoding 


unit 115 is interposed between the base station controller 112 
and the MSC 116. In this embodiment, an additional inter- 
face designated the "T- interface" is provided between the 
base station controller 112 and the transcoding unit 115, and 
the transcoding unit 115 communicates with the MSC 116 
over a standard interface such as the GSM "A" interface. 

[0124] Aspects of some of the communication interfaces 
shown in FIG. 10 will now be described in more detail, 
starting with the "O-interface"560 between the wireless 
access communication unit 106 and the base station 109. 
The "O-interface"560 comprises one or more wireless over- 
the-air communication channels, each channel preferably 
(but not necessarily) including a forward communication 
link and a reverse communication link to support full duplex 
communication. The over-the-air communication cbannel(s) 
of the O-interface 560 may be implemented according to any 
of a variety of different multiple-access communication 
protocols, including protocols utilizing time division mul- 
tiple access (TDMA). frequency division multiple access 
(FDMA), or code division multiple access (CDMA), or 
various combinations thereof. The O-interface 560 may 
include, in some alternative embodiments, wireless broad- 
cast channels from the base station 109 that are used, for 
example, for transmitting control traffic and signaling infor- 
mation. In other embodiments dedicated broadcast control 
channels are not used. 

[0125] One possible communication protocol that may be 
used for communicating across the O-interface 560 in one 
embodiment of the present invention is depicted in FIG. 16. 
The protocol depicted in FIG. 16 makes use of time division 
multiple access (TDMA) and spread spectrum techniques. 
As shown in FIG. 16, a polling loop 1380 ("major frame") 
comprises a plurality of time slots 1381 ("minor &ames"). 
Each minor frame 1381 comprises communication between 
a base station (e.g., cellular station) and a user station (e.g. 
mobile user) in time division duplex — that is, the base 
station transmits to a user station and the user station 
transmits back to the base station within the same minor 
frame 1381. 

[0126] Another communication protocol that may be used 
for communication across the O-interface 560 is depicted in 
FIG. 17. The protocol depicted in FIG. 17 uses aspects of 
both FDMA (in the sense that transmissions are distin- 
guished by different frequency allocations) and TDMA (in 
the sense that transmissions are distinguished by separate 
lime allocations). As shown in FIG. 17, one frequency band 
1510 is allocated to a base station 109 for base-to-user 
transmissions, and another frequency band 1511 is allocated 
to user stations (e.g., handsets, or other wireless units) for 
user-to-base transmissions. A repeating major time frame (or 
"polling loop") 1501 is defined for communication over 
each frequency band 1510. 1511. A plurality (e.g., sixteen) 
of base time slots 1502 and user time slots 1503 are defined 
within the repeating major time frame 150D, with the user 
time slots 1503 preferably lagging behind the base time slots 
1502 by an amount of time. In a preferred embodiment, in 
which sixteen base time slots 1502 and sixteen user time 
slots 1503 are defined in each major time frame 1501, the 
time lag 1505 between the first base time slot 1502 and first 
user time slot 1503 is a preset amount of time corresponding 
to a number of time slots, such as eight time slots, and is 
therefore referred to as a "slot offset." This time lag or slot 
oSset 1505 allows user stations time to receive transmis- 
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sions over the base frequency band 1510 in the assigned base 
time slot 1502, process the base-to-user transmissions, per- 
form a transmit/receive frequency switch, and transmit a 
reverse link transmission in the corresponding user time slot 
1503, without having to wait an entire time frame duration 
to transmit a reverse link transmission. The slot offset 1505 
can comprise an amount of time other than eight time slots, 
or the major time frame 1501 can be defined such that there 
is no slot offset 1505 at all. 

[0127] In one aspect of a preferred communication proto- 
col, a single base time slot 1502 and a single user time slot 
1503 collectively comprise a duplex communication chan- 
nel. In a preferred embodiment, the time frame 1501 of the 
protocol described with reference to FIG. 17 supports 
sixteen base time slots 1502 and sixteen corresponding user 
time slots 1503, for a total of sixteen possible duplex 
communication channels. In a preferred embodiment, each 
base time slot 1502 and user time slot 1503 is 1.35 milli- 
seconds in duration, and each time slot permits 9.6 kilobits/ 
second for the transmission of encoded speech or other data. 

[0128] Communication channels are preferably assigned 
to the wireless access communication unit 106 on a demand 
basis, although they may, in certain embodiments, be pre- 
allocated as well. An advantage of dynamic assignment of 
over-the-air communication channels is that more users can 
be supported. For the protocol shown in FIG. 17, over-the- 
air communication channels are preferably assigned based 
on requests from the wireless access communication unit 
106 to the base station 109. The assignment of over-the-air 
communication channels is carried out in the same fashion 
for mobile users (if any) that also communicate with the base 
station 109 — i.e., according to the cellular communication 
protocol for the network of which the base station 109 is a 
part. For example, over-the-air communication channels 
may be assigned with the assistance of a dedicated control 
channel. Over-the-air communication channels may also be 
assigned according to techniques similar to those described 
in, for example. U.S. patent application Ser. No. 08/463,220 
filed on Jun. 5, 1995, hereby incorporated by reference as if 
set forth fully herein. Any other suitable mechanism for 
allocating or assigning over-the-air communication channels 
may also be used. 

[0129] Details of a preferred I-interface 561 may be found 
in, e.g., U.S. patent application Ser. No. 08/610,193 filed on 
Mar. 4, 1996, hereby incorporated by reference as if set forth 
fully herein. Further details of the I-interface are also 
discussed herein with respect to FIG. 5. 

[0130] The N-interface 562 connects the base station 109 
to the base station controller 112. and comprises both traffic 
and signaling communication channels. At the physical 
layer, the N-interface 562 uses a fractional Tl service as the 
transport mechanism. Each fractional Tl link supports trans- 
fer rates from 64 kilobits/second up to 1.536 megabits/ 
second. Each time slot on the Tl link supports up to four 16 
kilobit/second bearer channels. 

[0131] The traffic channels of the N-interface 562 include 
non-aggregated 16 kilobit/second channels for carrying data 
(e.g., speech data) for one radio traffic channel (i.e., one 
over-the-air communication channel). Up to four such traffic 
channels can be multiplexed into one 64 kilobits/second Tl 
time slot. A single signaling channel is provided for each 
base station 109 for carrying signaling and OAM&P infor- 


mation, at a rate of 64 kilobits/second. The signaling traffic 
includes control information pertaining to the link between 
the base station 109 and the base station controller 112, as 
well as signaling traffic relayed between the wireless access 
communication unit 106 and the MSC 116. 

[0132] FIG. 7 shows in more detail the interface signaling 
structures for the N-interface 562 used in conjunction with 
a preferred embodiment of the invention. As shown in FIG. 
7, a base station controller (BSC) 702 is connected to a base 
station (OBTS) 703 over a plurality of logical links 711 
through 715, all of which are, from a physical standpoint, 
multiplexed onto a single digital timeslot channel (or DS0) 
and transmitted using pulse code modulation (PCM). The 
base station 703 shown in FIG. 7 comprises two transceivers 

706, 707 (designated "TRXr and TRX2," respectively), 
which are identified by terminal endpoint identifiers TEI B 
and TEI C, respectively, and a base common function (BCF) 
705, which is identified by terminal endpoint identifier TEI 
A. 

[0133] Signaling messages for traffic control are transmit- 
ted on two of the logical links 713 and 715, one of each 
connected to transceivers 706 and 707, Signaling messages 
carried by logical links 713 and 715 for interactions between 
the base station 703 and base station controller 702 relate to 
functions such as, for example, backhaul and radio resource 
management, and mobility management. Signaling mes- 
sages carried by channels 713 and 715 also relate to end- 
to-end call control and mobility management signaling 
between the wireless access communication unit 106 and the 
MSC 116, and are encapsulated Pithily transport notes. In 
addition, observation counters and operation measurements 
sent by the base station 703 to the base station controller 
702, and encapsulated within transport notes, can be con- 
veyed across logical links 713 and 715. 

[0134] Messaging related to management functions (such 
as OAM&P) is carried on logical links 711, 712 and 714, to 
the base common function 705 and transceivers 706 and 

707, respectively. The OAM&P messaging provides for 
management of the base station 703 by the base station 
controller 703. 

[0135] In a preferred embodiment, the base station con- 
troller 112 is connected to a transcoding unit 115 over an 
T- interface, which is shown in FIG. 1 but not explicitly 
shown in FIG. 10. The T-interface links the base station 
controller 112 to the transcoding unit 115 over a Tl con- 
nection, which carries a variety of different links, including 
bearer voice channel links and signaling links. The T-inter- 
face carriers a plurality of 16 kilobits/second bearer voice 
channels containing coded, encrypted voice and FEC infor- 
mation, along with inband signaling information between 
the base station 109 and the transcoding unit 115 (i.e., the 
endpoints of the encryption/decryption algorithms). In one 
embodiment, up to four such bearer voice channels can be 
multiplexed onto one DS0 timeslot. The bearer voice chan- 
nels are processed for transcoding and rate adaptation func- 
tionality by the transcoding unit 115, which formats the 
bearer voice channel data into 64 kilobits/second pulse -code 
modulated (PCM) voice data for relay to the MSC 116. 

[0136] In addition to bearer data, the T-interface also 
carries one or more signaling links. For example, the T-in- 
lerface carries signaling links for OAM&P control of the 
transcoding unit 115 by the base station controller 112, using 
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a standard LAPD data link The T-interface also carries SS7 
signaling links between the base station controller 112 and 
the MSG 116, each using one Tl DS0 timeslot. The signal- 
ing information on these links is relayed transparently 
between the base station controller 112 and the MSC 116 
through the transcoding unit 115. The T-interface may also 
optionally carry the communication link between the base 
station 109 and the operations management center (OMC) 
120. 

[0137] The transcoding unit 115 (if provided) is connected 
to the MSC 116 over a standard interface such as the GSM 
A- interface. Alternatively, the functionality of the transcod- 
ing unit 115 may be incorporated in the base station con- 
troller 112, which then would connect to the MSC 116 over 
a standard interface such as the GSM A-interface. The 
A- interface is depicted in FIG. 1, and is also denoted in 
FIG. 7 by reference numeral 571. Details of the GSM 
A-interface are described in, for example, "Mobile Switch- 
ing Center (MSC) to Base Station Subsystem (BSS) Inter- 
face; Layer 3 Specification," GSM Recommendation 08.08. 
Preferably, some modifications are made to the standard 
GSM A-interface to support the features and functionality of 
the preferred embodiment or embodiments described herein. 
Such modifications may include, for example, using a Tl 
line as the physical interface to carry both traffic and 
signaling, and using i-law coding in certain geographical 
regions (such as North America). 

[0138] Signaling links for the A-interface, in general, 
logically run between the base station controller 112 and the 
MSC 116, whereas the bearer links span between the 
transcoding unit 115 and the MSC 116. The transcoding unit 
115, as noted, processes the 16 kilobits/second bearer links 
received over the T-interface, and generates 64 kilobits/ 
second pulse-code modulation links towards the MSC 116. 
The A-interface signaling channels carry signaling connec- 
tion control part (SCCP) logical signaling links. An SCCP 
link is maintained between the base station controller 112 
and the MSC 116 for each active CPE trunk (or "logical 
mobile station") of the wireless access communication unit 
106 that is communicating with the PSTN 125. Signaling 
information carried over the A-interface includes SS7 sig- 
naling between the base station controller 112 and the MSC 
116 for management of the link, A-interface radio resource 
management signaling, A-interface mobility management 
signaling, call control signaling, between the wireless access 
communication unit 106 and the MSC 116 relayed through 
the base station controller 112, and, optionally OAM&P 
signaling between the base station controller 112 and the 
OMC 120. The A-interface signaling traffic passes through 
the transcoding unit 115 (if provided), and the transcoding 
unit 115, as noted, relays the signaling information trans- 
parently between the base station controller 112 and the 
MSC 116. 

[0139] FIG. 8 is a diagram showing a protocol architec- 
ture for one particular embodiment of the preferred com- 
munication system 101, and further depicts a preferred 
relationship of connections among the wireless access com- 
munication unit 106, base station 109, base station controller 
112, and MSC 116 across the O-interface 560, N-interface 
562 and A-interface 571. In the protocol architecture shown 
in FIG. 8, "CM" relates to connection management, "MM" 
relates to mobility management, "OTA" relates to the over- 
the-air protocol, "LAPD" relates to link access protocol for 


the ID channel, "IWF" relates to an interworking function, 
"Ph L" relates to the physical layer, "BSSMAP" relates to 
the base station subsystem management application part, 
"SCCP" relates to SS7 signaling connection control part, 
"MTP" relates to message transfer part (MTP Layers 2 and 
3), "OAM" relates to operations, maintenance and admin- 
istration, "NTS -MM" relates to N-Notes mobility manage- 
ment, and "NTS-RR" relates to N-Notes radio resource 
management. 

[0140] The call control protocol is the GSM direction 
transfer application part (DTAP) call control entity, shown 
as the GSM-CM layer in FIG. 8. This GSM DTAP call 
control entity (i.e., GSM-CM layer) supports a variety of 
features, including (1) the establishment, maintenance and 
release of normal outgoing voice calls (i.e., originating from 
the CPE 105) between the wireless access communication 
unit 106 and the MSC 116; (2) the establishment, mainte- 
nance and release of emergency (i.e., "911") outgoing voice 
calls between the wireless access communication unit 106 
and the MSC 116; and (3) the signaling of DTMF tones from 
the CPE 105 in the network direction during active calls. 
Preferably, transparent digit transmission is provided 
between the wireless access communication unit 106 and the 
base station 109, since digit analysis is preferably carried out 
at the base station 109. Further, the system also preferably 
provides transport capability via control transfer (CT-TRA) 
O -Notes for DTAP protocol messages. 

[0141] A GSM DTAP mobility management entity, shown 
as the GSM-MM layer in FIG. 8, is used end-to-end 
(between the wireless access communication unit 106 and 
the MSC 116) to run various mobility management proce- 
dures, including authentication and subscriber identification. 
Other mobility management procedures are supported on the 
O-interface 560 and the N-interface 562 as part of the 
protocols utilizing O -Notes and N-Notes, and are shown as 
the OTA-MM entity and NTS-MM entity in FIG. 8. 

[0142] The GSM-CM and GSM-MM protocol runs end- 
to-end between the wireless access communication unlit 106 
and the MSC 116, and the protocol messages are relayed 
transparently through the base station 109 and the base 
station controller 112. The protocol messages may be encap- 
sulated within transport O-Notes (CT-TRA) messages across 
the O-interface 560, transport N-Notes messages across the 
N-interface 562 using the LAPD signaling link between the 
base station 109 and base station controller 112, and BSS- 
MAP messages over the A-interface 571 using the SCCP 
signaling link. 

[0143] The over-the-air mobility management procedures 
are interworked in the base station 109 with N-Notes mobil- 
ity management procedures, shown as the NTS-MM Layer 
in FIG. 8. The NTS-MM procedures run over the LAPD 
signaling link of the N-interface 562, and are interworked in 
the base station controller 112 with corresponding DTAP 
mobility management (GSM-MM) procedures on the A-in- 
terface 571. The GSM-MM protocol therefore runs partly 
end-to-end between the wireless access communication unit 
106 and the MSC 116, and partly between the base station 
controller 112 and the MSC 116. 

[0144] Over-the-air radio resource management functions 
are provided by an OTA radio resource (OTA-RR) manage- 
ment protocol entity shown in FIG. 8. Such radio resource 
management functions include link acquisition, lost link 
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recovery, bearer message ciphering, over-the-air slot nego- 
tiation and time slot interchange (in a TDMA system), digit 
transmission and analysis assignment and mode change, link 
release (whether initiated by the network or wireless access 
communication unit 106), base assist information, and sur- 
rounding base table information. On the O-interface 560, the 
radio resource management is carried out as part of the 
O-Notes protocol by the OTA-RR entity. 

[0145] Over the N-interface 562, the NTS-RR protocol 
procedures for radio resource management include cipher- 
ing, assignment and mode change, and link release. In 
addition to radio resource functions, the functionality of the 
NTS-RR entity includes procedures to manage the allocation 
and de-allocation of bearer channels on the backhaul link(s) 
of the N-interface 562. 

[0146] Various BSSMAP procedures are provided on the 
A- interface 571 for supporting the functionality of the 
wireless access communication unit 106. These BSSMAP 
procedures include, for example, assignment, blocking, 
reset, release, cipher mode control, and initial message. 

[0147] Mobility management connection establishment 
for normal calls is initiated by the mobility management 
entity (i.e., GSM-MM entity shown in FIG. 8) of the 
wireless access communication unit 106. To do so, the 
mobility management entity sends a Connection Manage- 
ment (CM) Service Request message to the MSC 116, with 
the Service Type field indicating a normal call. The MSC 
116 responds by sending a CM Service Accept message. 
Upon receiving a CM Service Accept message from the 
MSC 116, the wireless access communication unit 106 
continues with normal call set-up, as further described 
herein and/or in related applications incorporated by refer- 
ence elsewhere herein. 

[0148] For normal calls, the mobility management con- 
nection establishment procedure may encompass an authen- 
tication procedure. Such a procedure may be based on the 
DTAP mobility management signaling for authentication, 
and may run end-to-end between the MSC 116 and the 
wireless access communication unit 106. 

[0149] For emergency (i.e., "911") calls, the mobility 
management entity (i.e., GSM-MM entity shown in FIG. 8) 
of the wireless access communication unit 106 initiates a 
mobility management connection establishment procedure 
by sending a CM Service Request message, with the CM 
Service Type field indicating an emergency call to the MSC 
116. In response, the MSC 116 transmits a CM Service 
Accept message to the wireless access communication unit 
106. Upon receiving the CM Service Accept message from 
the MSC 116, the wireless access communication unit 106 
continues with emergency call setup. For emergency calls, 
the network need not invoke an authentication procedure. 

[0150] If the service request is rejected by the MSC 116, 
or if a service request time-out expires, the wireless access 
communication unit 106 may issue a reorder tone to the CPE 
105. and abort the call establishment procedure. 

[0151] Although the wireless access communication unit 
106 preferably utilizes a mobility management connection 
establishment procedure in the establishment of a call con- 
nection, the CPE trunks typically do not constitute mobile 
components of the system. The communication system 101 
adapts techniques utilized in a mobile communication sys- 


tem for facilitating setup and maintenance of a wireless 
trunk 108 through the wireless access communication unit 
106, as generally described herein. Using aspects of a 
mobile communication system in the communication system 
101 which includes the wireless access communication unit 
106 has the advantage of allowing existing mobile commu- 
nication system infrastructures to support a wireless trunk in 
accordance with the present invention, without requiring a 
separate base station subsystem or other dedicated wireless 
path to the PSTN 125 to be constructed. 

[0152] After the mobility management connection estab- 
lishment procedure has been completed, the wireless access 
communication unit 106 exchanges DTAP signaling with the 
MSC 116 to set up an outgoing call. The primary difference 
between normal and emergency call setup procedures is in 
the way the call is initiated. For a normal call, the wireless 
access communication unit 106 sends a DTAP Setup mes- 
sage to the base station 109 with the Called Address field 
empty. The base station 109 fills in the Called Address field 
of the Setup message with the digits stored earlier as part of 
the digit analysis procedure, before relaying the Setup 
message to the MSC 116 across the base station controller 
112. For an emergency call, the wireless access communi- 
cation unit 106 sends a DTAP Emergency Setup message to 
the MSC 116. The DTAP Emergency Setup message is 
relayed transparently through the base station 109 and the 
base station controller 112. The MSC 116 returns a DTAP 
Call Proceeding message to indicate acceptance of the call 
request. 

[0153] Further aspects of the invention relate to security 
features of a preferred communication system 101 including 
the wireless access communication unit 106. Such security 
features include, for example, authentication and ciphering. 

[0154] Because the wireless access communication unit 
106 may make use of wireless resources of a nearby mobile 
cellular system, a possibility exists that outside parties may 
attempt to make illegal use of the identity of the wireless 
access communication unit 106 in the same manner that 
such parties attempt to make illegal use of mobile handsets. 
For example, in many analog mobile telephone networks 
mobile telephones can be cloned, causing large amounts of 
revenue to be lost due to illegal use of such telephones. 

[0155] The preferred communication system 101 prefer- 
ably uses an authentication procedure to prevent unautho- 
rized use of network resources, and to protect the wireless 
access communication unit 106 (and other wireless entities) 
from fraudulent impersonations. Authentication is prefer- 
ably performed with each user registration, as well as part of 
normal call setup on a 1-in-N basis — i.e., once every N calls 
authentication is performed, with N being configurable 
within the system. 

[0156] In a preferred embodiment, authentication requests 
and responses are passed between the MSC 116 and the 
wireless access communication unit 106 as part of the GSM 
mobility management (MM) protocol, and are based on the 
GSM A3/A8 authentication mechanism. At the user end, the 
wireless access communication unit 106 contains a standard 
GSM SIM function for each CPE trunk. A subscriber iden- 
tity (i.e., IMSI) and subscriber key value (K^ are stored in 
the wireless access communication unit 106 for each CPE 
trunk, within the GSM SIM function associated with the 
CPE trunk. At the network end, the MSC 116 requests an 
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authentication information set from the home location reg- 
ister (HLR) component of the HLR/AuC 123. In a preferred 
embodiment, the authentication information set comprises a 
set of three authentication parameters referred to herein as 
an authentication triplet. The HLR component of the HLR/ 
AuC 123 stores authentication information sets (previously 
requested and transferred from the AuC component of the 
HLR/AuC 123) from which it may select the authentication 
triplet requested by the MSC 116, or it may request a new 
authentication triplet from the AuC component of the HLR/ 
AuC 123 and transfer the new set to the MSC 116. 

[0157] An authentication triplet comprises a generated 
random number (RAND), a signed response (SRES) used 
for the authentication of a subscriber's SIM card, and a 
ciphering key (KJ used to encrypt and decrypt information 
across the radio link between the wireless access commu- 
nication unit 106 and the network. The subscriber key value 
Kj stored at both the AuC component of the HLR/AuC 123 
and at the wireless access communication unit 106 is used in 
either two separate algorithms (generally known in the art as 
A3 and A8) or in a combined A3/A8 algorithm which 
generates the ciphering key K<. and the signed response 
SRES for authentication procedures. A random number 
generator is used at the AuC component of the HLR/AuC 
123 to generate the random number RAND, which is sent by 
the MSC 116 to the wireless access communication unit 106. 
The wireless access communication unit 106 feeds the 
random number RAND along with the subscriber key value 
Ki into the A3 algorithm to generate the signed response 
SRES, and into the A8 algorithm to generate the ciphering 
key K,. 

[0158] The signed response SRES is returned to the MSC 
116 and is subsequently compared by the visitor location 
register (VLR) with the signed response value in the VLR. 
If the returned signed response SRES matches the signed 
response value in the VLR, the subscriber is authorized to 
register, make calls, and carry out other network interac- 
tions. If, on the other hand, the returned signed response 
SRES does not match the signed response value in the VLR, 
then the subscriber is blocked from registering, making 
calls, and carrying out other network interactions. In such a 
case, the base station 109 is informed by the MSC 116 that 
the authentication attempt resulted in a failure, and the base 
station 109 terminates the call connection to the wireless 
access communication unit 106 with an authentication fail- 
ure message, 

[0159] Preferably, the AuC component of the HLR/AuC 
123 and the SIM components are the only parts of the 
network which know about the existence of a subscriber key 
value Ki and the A3/A8 algorithm(s). The AuC component 
of the HLR/AuC 123 generates a new random number 
RAND for each authentication request, and derives the 
signed response SRES and ciphering key K,. which are then 
passed to the HLR component of the HLR/AuC 123 and 
MSC 116 as needed. The MSC 116 need not be involved in 
the actual derivation of the signed response SRES or the 
ciphering key K<.. 

[0160] FIG. 18 is a diagram illustrating authentication 
procedures, including division of functionality, in a pre- 
ferred embodiment of the communication system 101. As 
shown in FIG. 18, an authentication triplet including a 
random number RAND, signed response SRES, and cipher- 


ing key K^. are stored in the VLR of the MSC 116, after being 
transferred upon request from the HLR/AuC 123. The 
random number RAND is sent to the wireless access com- 
munication unit 106, whereupon it is applied along with the 
subscriber key value K, to locally generate the signed 
response SRES and ciphering key K,,. The signed response 
SRES is returned by the wireless access communication unit 
106 to the MSC 116 for comparison against the SRES stored 
at the VLR of the MSC 116. The ciphering key is used 
thereafter for ciphering transmissions across the wireless 
communication channel. 

[0161] Bearer ciphering at the user end is performed at the 
wireless access communication unit 106. Ciphering of 
bearer information on the network end is preferably carried 
out at the transcoding unit 115. Ciphering of signaling 
messages (e.g., control traffic) may optionally be carried out. 
A wide variety of suitable algorithms may be selected for 
bearer ciphering. For example, the GSM A5/1 algorithm 
may be utilized for such a purpose. 

[0162] As part of call establishment, ciphering may be set 
up using a cipher mode setting procedure in conjunction 
with establishment of the ciphering key during the 
authentication process. The ciphering key K,. may be relayed 
from the MSC 116 to the base station controller 112, which 
in turn relays it to the base station 109 using signaling 
messages across the N-interface 562. The base station 109 in 
turn relays the ciphering key K,. back to the transcoding unit 
115, using inband signaling. 

[0163] Further details regarding registration, de-registra- 
tion and call setup will now be described, FIG. 17 is a call 
flow diagram illustrating a network-level registration pro- 
cedure. As a first step in the procedure illustrated in FIG. 12, 
the wireless access communication unit 106 acquires a 
wireless communication channel (e.g., a time slot in a 
TDMA or TDD system, or a frequency channel in an FDD 
system, or other defined channel) to a nearby base station 
109. The wireless communication channel is acquired 
according to the particular protocol utilized by the wireless 
system. The wireless access communication unit 106 then 
performs a network -level registration procedure, according 
to the particular registration protocol utilized by the system. 
The registration procedure may involve, for example, a 
location updating procedure on the A-interf ace. The wireless 
access communication unit 106 performs network-level reg- 
istration at regular intervals thereafter, with periodicity 
controlled by the network infrastructure. The wireless access 
communication unit 106 may also perform network-level 
registration if it starts communicating through a base station 
109 in a different location area from the base station with 
which it had been previously communicating. After regis- 
tration, the wireless communication channel is surrendered, 
and the MSC 116 initiates a resource release procedure, as 
illustrated in FIG. 12. 

[0164] In addition to network-level registration, the wire- 
less access communication unit 106 may also perform 
periodic registration with the base station 109 at regular 
intervals, with a periodicity controlled by the base station 
109. For each registration attempt, the wireless access 
communication unit 106 acquires a wireless communication 
channel, registers, and then surrenders the wireless commu- 
nication channel, unless a call is in progress. If a call is in 
progress, the wireless communication unit 106 need not 
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acquire a new channel, but can, if possible under the 
particular wireless protocol, send registration information 
over the existing communication channel. In addition to 
periodic base-level registration, the wireless access commu- 
nication unit 106 also performs initial registration with a 
base station 109 when it starts communicating through a 
base station different from but in the same location area as 
a base station with which it was previously communicating. 

[0165] De-registration is performed by the system on 
behalf of each CPE trunk connected to the wireless access 
communication unit 106 when the wireless access commu- 
nication unit 106 is powered off. FIG. 13 is a call flow 
diagram illustrating a network level de-registration proce- 
dure. As a first step in the procedure illustrated in FIG. 13, 
the wireless access communication unit 106 acquires a 
wireless communication channel (e.g., a TDM A time slot) to 
a nearby base station 109. The wireless communication 
channel is acquired according to the particular RF protocol 
utilized by the wireless system. The wireless access com- 
munication unit 106 then performs a network-level de- 
registration procedure, such as an IMSI detach procedure, 
according to the particular protocol utilized by the system. 
After de -registration, the wireless communication channel is 
surrendered, and the MSC 116 initiates a resource release 
procedure, as illustrated in FIG. 13. 

[0166] After registration by the wireless access commu- 
nication unit 106, outgoing calls ma be placed to the PSTN 
125 via the CPE 105, wireless access communication unit 
106 and base station subsystem. This will generally involve 
provision of a dial tone, digit transmission, digit analysis and 
call setup for outgoing calls under various types of CPE 
embodiments, including PBXs and KTSs with different 
levels of routing intelligence. These procedures are 
described in more detail in the copending applications 
previously incorporated herein by reference. 

[0167] FIGS. 14 and 15 are call flow diagrams illustrating 
successful call setup procedures in two scenarios. FIG. 14 
illustrates a call flow for a successful CPE-originated normal 
(i.e., non-emergency) call setup sequence, with non-PSTN 
interworking at the MSC 116. As depicted in FIG. 14, 
provision of the dial tone, transmission of digits and digit 
analysis is carried out according to techniques described in 
the copending applications previously incorporated herein 
by reference. In each instance the call flow terminates with 
an end of dialing indication from the base station 109 to the 
wireless access communication unit 106. Upon receiving the 
end of dialing indication from the base station 109, the 
wireless access communication unit 106 initiates a mobility 
management connection establishment procedure for a nor- 
mal call. This procedure results in an SCCP link being 
established for the call across the A-interface (assuming a 
GSM system), and further results in a mobility management 
connection being set up with the MSC 116 for handling the 
call. Part of this procedure may. if desired, entail authenti- 
cation and cipher mode setting procedures for the call. 

[0168] After completion of the mobility management con- 
nection procedure, the wireless access communication unit 
106 sends a direct transfer application part (DTAP) Setup 
message to the base station 109, as illustrated in FIG. 14. 
The DTAP Setup message contains an empty called party 
address field, and is directed towards the MSC 116. The base 
station 109 intercepts the DTAP Setup message and fills in 


the called address field with the digits received from the 
wireless access communication unit earlier during the digit 
analysis step. The base station 109 then forwards the DTAP 
Setup message, via the base station controller 112, to the 
MSC 116. The MSC 116 acknowledges the receipt of the 
DTAP Setup message by sending a DTAP Call Proceeding 
message to the wireless access communication unit 106, as 
illustrated in FIG. 14, 

[0169] A bearer resource assignment procedure is then 
executed on each interface of the wireless fixed-access 
system, starting from the A-interface and progressing to the 
O -interface. The bearer resource assignment procedure 
results in bearer channels being assigned on the A-interface, 
N-interface and O-interface, and a switched connection 
being set up through the base station controller 112. 

[0170] After the bearer resource assignment procedure is 
complete, the MSC 116 sends a DTAP Alerting message to 
the wireless access communication unit 106. The wireless 
access communication unit 106 provides a ringback tone to 
the user 102, via the inband path through the CPE 105 (i.e., 
the PBX or KTS, or other similar system). When the called 
party answers the call, the MSC 116 sends a DTAP Connect 
message to the wireless access communication unit 106. At 
that point the wireless access communication unit 106 
attaches its speech path and removes the ringback tone to the 
user 102. Hie wireless access communication unit 106 
responds to the MSC 116 with a DTAP Connect Acknowl- 
edgment message, and the call is then in a conversation state. 

[0171] FIG. 15, like FIG. 14, illustrates a call flow for a 
successful CPE-originated normal call setup sequence, but 
with PSTN interworking at the MSC 116. As depicted in 
FIG. 15, provision of the dial tone, transmission of digits 
and digit analysis is carried out as described with respect to 
FIG. 14. Upon receiving an end of dialing indication from 
the base station 109, the wireless access communication unit 
106 initiates a mobility management connection establish- 
ment procedure for a normal call. Similar to the call flow of 
FIG. 14, this procedure results in an SCCP link being 
established for the call across the A-interface (assuming a 
GSM system), and further results in a mobility management 
connection being set up with the MSC 116 for handling the 
call. Part of this procedure may, if desired, entail authenti- 
cation and cipher mode setting procedures for the call. 

[0172] After completion of the mobility management con- 
nection procedure the wireless access communication unit 
106 sends a DTAP Setup message to the base station 109. 
The DTAP Setup message contains an empty called party 
address field, and is directed towards the MSC 116, The base 
station 109 intercepts the DTAP Setup message and fills in 
the called address field with the digits received from the 
wireless access communication unit earlier during the digit 
analysis step. The base station 109 then forwards the DTAP 
Setup message, via the base station controller 112, to the 
MSC 116. The MSC 116 acknowledges the receipt of the 
DTAP Setup message by sending a DTAP Call Proceeding 
message to the wireless access communication unit 106, as 
illustrated in FIG. 15. A bearer resource assignment proce- 
dure is then executed on each interface of the wireless 
fixed-access system, starting from the A-interface and pro- 
gressing to the O-interface, similar to the call flow of FIG. 
14. The bearer resource assignment procedure results in 
bearer channels being assigned on the A-interface, N-inter- 


05/14/2004, EAST Version: 1.4.1 


US 2002/0176581 Al 


19 


Nov. 28, 2002 


face and O-interface, and a switched connection being set up 
through the base station controller 112. 

[0173] After the bearer resource assignment procedure is 
complete, the MSC 116 sends a DTAP Progress message to 
the wireless access communication unit 106, indicating 
interworking with the PSTN 125. The wireless access com- 
munication unit 106 attaches its speech path at this point. 
The network senses the ringback tone over the connected 
speech path, and the ringback tone is relayed by the wireless 
access communication unit 106 to the user 102, via the CPE 
105 (i.e., the KTS or PBX, or other similar system). When 
the called party answers the call, the network removes the 
ringback tone. The MSC 116 sends a DTAP Connect mes- 
sage to the wireless access communication unit 106. The 
wireless access communication unit 106 responds with a 
DTAP Connect Acknowledgment message and the call then 
moves to a conversation state. 

[0174] In either call flow scenario depicted in FIG. 14 or 
15, if the called party is busy, the call will generally be 
rejected. In the case of non-PSTN interworking, a busy tone 
is sent from the wireless access communication unit 106 to 
the user 092 in response to a DTAP Disconnect message 
from the MSC 116, and a DTAP release procedure is 
initiated. When an on-hook signal is detected from the user 
102, the wireless access communication unit 106 initiates a 
call resource release procedure. In the case of PSTN- 
interworking, the busy tone is sent from the PSTN 125. 
When the CPE 105 detects an on-hook signal from the user 
102, it sends a disconnect message to the wireless access 
communication unit 106, which then initiates a DTAP 
release procedure followed by a call resource release pro- 
cedure. 

[0175] While one or more embodiments have been 
described above in accordance With various aspects of the 
present invention, a number of variations of these embodi- 
ments exist incorporating the same or similar principles of 
operation as described herein. For example, it will be 
apparent to one skilled in the art that the functionality of the 
CPE and the wireless access communication unit can be 
combined into a single unit. Also, one or more telephone 
stations can be connected directly to the wireless access 
communication unit 106, bypassing the CPE 105. Also, the 
CPE 105 need not be connected to the telephone stations 102 
with telephone lines, but may be wirelessly connected 
thereto (i.e., a wireless PBX). 

[0176] A local area communication system according to 
certain aspects of the present invention may be compara- 
tively easy to deploy in remote and/or rural areas, in contrast 
to systems requiring landline connections from a PBX or 
KTS to the network. With the addition of connecting the 
wireless access communication unit to the PBX or KTS, a 
remotely-located local area communication system can 
obtain benefits of a wireless network (including long dis- 
tance access) for relatively little extra deployment effort. 

[0177] While preferred embodiments of the invention 
have been described herein, many variations are possible 
which remain within the concept and scope of the invention. 
Such variations would become clear to one of ordinary skill 
in the art after inspection of the specification and the 
drawings. The invention therefore is not to be restricted 
except within the spirit and scope of any appended claims. 


What is claimed is: 

1. A method for authentication in a wireless communica- 
tion system, comprising the steps of: 

establishing a wireless connection between a wireless 
access communication unit and a network; 

transmitting a subscriber identifier from said wireless 
access communication unit to the network, said sub- 
scriber identifier corresponding to a subscriber port of 
said wireless access communication unit; 

transmitting a numeric value from the network to said 
wireless access communication unit; 

receiving said numeric value at said wireless access 
communication unit; 

generating a signed response at said wireless access 
communication unit based upon said numeric value and 
a locally stored user key value associated with said 
subscriber port of said wireless access communication 
unit; 

transmitting said signed response from said wireless 
access communication unit to the network; 

receiving said signed response at the network; 

comparing the signed response to an authentication 
parameter derived at the network; and 

disallowing access to the network for the subscriber 
associated with said subscriber identifier unless said 
signed response matches said authentication parameter. 

2. The method of claim 1, wherein said signed response 
is generated using a GSM A3 algorithm. 

3. The method of claim 1, wherein said step of transmit- 
ting a subscriber identifier from said wireless access com- 
munication unit is carried out upon registration of the 
subscriber associated with said subscriber identifier. 

4. The method of claim 1 , wherein said step of transmit- 
ting a subscriber identifier from said wireless access com- 
munication unit is carried out upon an attempt to establish a 
call. 

5. The method of claim 1, further comprising the step of 
completing a call from a user connected to said wireless 
access communication unit to the network if access to the 
network is not disallowed, said call being associated with 
said subscriber identifier. 

6. The method of claim 5, further comprising the step of 
completing a said call from said first user and completing a 
second call from a second user connected to said wireless 
access communication unit, said second call being associ- 
ated with the same subscriber identifier. 

7. The method of claim 1, further comprising the step of 
generating a ciphering key from said user key value and said 
numeric value. 

8. The method of claim 7, wherein said ciphering key is 
generating using a GSM A8 algorithm. 

9. A wireless access communication unit, comprising: 

at least one subscriber port connected to a local area 
telephone switch, whereby a communication path can 
be established between said wireless access communi- 
cation unit and one or more users; 

a subscriber interface connected to said subscriber port; 

a radio transceiver for transmitting and receiving infor- 
mation over a wireless connection to a base station; 
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a controller connected to said radio transceiver and said 
subscriber interface, said controller managing the trans- 
fer of information between said radio transceiver and 
said subscriber interface; and 

a subscriber identity module connected to said subscriber 
interface, said subscriber identity module comprising a 
non-volatile memory storing a subscriber identifier and 
a user key value, said subscriber identity module out- 
putting a signed response value in response to an 
authentication parameter received by said radio trans- 
ceiver over said wireless connection. 

10. The wireless access communication unit of claim 9, 
wherein said authentication parameter comprises a random 
numeric value. 

11. The wireless access communication unit of claim 10, 
wherein said subscriber identity module applies a GSM A3 
algorithm to said random numeric value and said user key 
value to output said signed response. 

12. The wireless access communication unit of claim 9, 
wherein said subscriber identity module outputs a ciphering 
key in response to said authentication parameter and said 
user key value. 

13. The wireless access communication unit of claim 12, 
wherein said subscriber identity module applies a GSM A8 
algorithm to said authentication parameter and said user key 
value to output said ciphering key. 

14. The wireless access communication unit of claim 12, 
wherein said controller utilizes said ciphering key to encrypt 
and decrypt information transferred between said radio 
transceiver and said subscriber interface. 

15. A method for authentication in a wireless communi- 
cation systems comprising the steps of: 

establishing a wireless connection between a wireless 
access communication unit and a network; 

transmitting a plurality of subscriber identifiers from said 
wireless access communication unit to the network, 
said subscriber identifiers corresponding to a plurality 
of subscriber ports of said wireless access communi- 
cation unit, one subscriber identifier for each subscriber 
port; 

transmitting a plurality of numeric values from the net- 
work to said wireless access communication unit, one 
numeric value being transmitted in response to each of 
said subscriber identifiers; 

receiving said numeric values at said wireless access 
communication unit; 

generating a plurality of signed responses at said wireless 
access communication unit, one signed response for 
each of said subscriber ports, each signed response 
based upon the numeric value corresponding to the 
subscriber identifier of the subscriber port and a locally 
stored user key value associated with the subscriber 
port; 

transmitting said signed responses from said wireless 
access communication unit to the network; and 

disallowing access to the network for any subscriber port 
unless said signed response for the subscriber port 
matches an authentication parameter derived at the 
network for the subscriber port, said authentication 
parameter based upon the numeric value corresponding 


to the subscriber identifier of the subscriber port and a 
network-stored user key value corresponding to the 
subscriber identifier of the subscriber port. 

16. The method of claim 15, wherein each signed 
response is generated using a GSM A3 algorithm. 

17. The method of claim 15, wherein said step of trans- 
mitting a plurality of subscriber identifiers from said wire- 
less access communication unit to said network is carried 
out individually for each subscriber port upon registration 
with the network. 

18. The method of claim 15, wherein said step of trans- 
mitting a plurality of subscriber identifiers from said wire- 
less access communication unit to said network is carried 
out upon an attempt to establish calls through said subscriber 
ports. 

19. The method of claim 15, further comprising the step 
of completing a call through one of said subscriber ports 
from a user connected to said wireless access communica- 
tion unit to the network if access to the network is not 
disallowed for that subscriber port. 

20. The method of claim 19 further comprising the step of 
completing a said call from said first user and completing a 
second call through said one of said subscriber ports from a 
second user connected to said wireless access communica- 
tion unit. 

21. The method of claim 15, further comprising the step 
of generating a plurality of ciphering keys, one ciphering 
key for each of said subscriber ports, each ciphering key 
being generated from said numeric value corresponding to 
the subscriber identifier of the subscriber port and said 
locally stored user key value associated with the subscriber 
port. 

22. The method of claim 21, wherein each of said cipher- 
ing keys is generating using a GSM A8 algorithm. 

23. A communication system, comprising: 

a wireless access communication unit, said wireless 
access communication unit comprising a plurality of 
user interfaces, a non-volatile storage containing a 
subscriber identifier and a user key value for each of 
said user interfaces; 

a base station comprising a radio unit whereby a wireless 
connection can be established between said wireless 
access communication unit and said base station; 

a mobile switching center connected to said base station, 
said mobile switching center retrieving into a set of 
authentication parameters for each of said user inter- 
faces upon occurrence of selected events and providing 
at least one of said authentication parameters to said 
wireless access communication unit via said base sta- 
tion; 

means located at said wireless access communication unit 
for receiving said at least one authentication parameter 
from said mobile switching center and for generating a 
signed response value based upon said at least one 
authentication parameter and said user-key value; and 

means located at said mobile switching center for receiv- 
ing said signed response value from said wireless 
access communication unit and for comparing said 
signed response value to a second one of said authen- 
tication parameters. 
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24. The communication system of claim 23, wherein one 
of said selected events comprises a registration request by 
said wireless access communication unit pertaining to one of 
said user interfaces. 

25. The communication system of claim 23, wherein one 
of said selected events comprises an attempt to establish a 
call from a user connected to one of said user interfaces to 
said network across said wireless access communication 
unit. 

26. The communication system of claim 25, wherein said 
mobile switching center further comprises means for allow- 
ing said call to be established if said signed response value 
matches said second one of said authentication parameters, 
and for otherwise preventing said call from being estab- 
lished. 

27. The communication system of claim 23, wherein said 
set of authentication parameters is stored in a home location 
register connected to said mobile switching center. 

28. The communication system of claim 23, wherein said 
authentication parameters are retrieved by the mobile 
switching center using a subscriber identity corresponding to 
the user interface. 

29. The communication system of claim 23, wherein said 
set of authentication parameters comprises a random num- 
ber, said random number generated at a location remote from 
said mobile switching center. 

30. The communication system of claim 23, wherein said 
set of authentication parameters comprises a ciphering key. 

31. A method for authentication in a communication 
system, comprising the steps of: 

establishing, upon demand, wireless connections between 
a wireless access communication unit and a cellular 
network, said wireless access communication unit con- 
nected over a plurality of trunks to a plurality of users 
each capable of generating a call request to said wire- 
less access communication unit; 

independently for each established wireless connection, 
transmitting a subscriber identifier from the wireless 
access communication unit to the cellular network; 

independently for each established wireless connection, 
undertaking an authentication procedure at said cellular 
network based upon the subscriber identifier received at 
the cellular network, said authentication procedure 
resulting in a pass or fail; and 

disallowing access to the cellular network to a subscriber 
associated with a transmitted subscriber identifier 
unless the authentication procedure results in a pass for 
that subscriber identifier. 

32. The method of claim 31, wherein each subscriber 
identifier is permanently associated with one of said trunks. 

33. The method of claim 31, wherein said step of under- 
taking an authentication procedure at said cellular network 
based upon the subscriber identifier received at the cellular 
network comprises the steps of: 

obtaining authentication parameters at said cellular net- 
work based upon the transmitted subscriber identifier, 
said authentication parameters comprising at least a 
numeric value and a first signed response value; 

transmitting said numeric value from the cellular network 
to the wireless access communication unit; 


receiving said numeric value at said wireless access 
communication unit; 

generating a second signed response value at said wireless 
access communication unit based upon said numeric 
value; 

transmitting said second signed response value from said 
wireless access communication unit to said cellular 
network; 

receiving said second signed response value at said cel- 
lular network; 

comparing said second signed response value to said first 
signed response value; and 

declaring a pass if said first signed response value 
matches said second response value, or else declaring 
a fail. 

34. The method of claim 33, wherein said step of obtain- 
ing authentication parameters at said cellular network com- 
prises the step of retrieving stored authentication parameters 
from a database within said cellular network. 

35. A method for authentication in a wireless communi- 
cation system, comprising the steps of: 

establishing a wireless connection between a wireless 
access communication unit and a network; 

transmitting a subscriber identifier from said wireless 
access communication unit to the networks said sub- 
scriber identifier corresponding to a subscriber port of 
said wireless access communication unit; 

transmitting an authentication parameter from the net- 
work to said wireless access communication unit; 

receiving said authentication parameter at said wireless 
access communication unit; and 

generating an authentication key at said wireless access 
communication unit based upon said authentication 
parameter and a locally stored user key value associ- 
ated with said subscriber port of said wireless access 
communication unit. 

36. The method of claim 35, wherein said authentication 
key comprises a signed response, said method further com- 
prising the steps of 

transmitting said signed response from said wireless 
access communication unit to the network; 

receiving said signed response at the network; 

comparing the signed response to a second authentication 
parameter derived at the network; and 

disallowing access to the network for the subscriber 
associated with said subscriber identifier unless said 
signed response matches said second authentication 
parameter. 

37. The method of claim 35, wherein said authentication 
key comprises a ciphering key, said method further com- 
prising the step of encrypting and decrypting messages 
transmitted across said wireless connection using said 
ciphering key. 

38. A wireless access communication unit, comprising: 

at least one subscriber port connected to a local area 
telephone switch, whereby a communication path can 
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be established between said wireless access communi- 
cation unit and one or more users; 

a subscriber interface connected to said subscriber port; 

a radio transceiver for transmitting and receiving infor- 
mation over a wireless connection to a base station; 

a controller connected to said radio transceiver and said 
subscriber interface, said controller managing the trans- 
fer of information between said radio transceiver and 
said subscriber interface; and 

a subscriber identity module connected to said subscriber 
interface, said subscriber identity module comprising a 
non-volatile memory storing a subscriber identifier and 
a user key value, said subscriber identity module out- 


putting an authentication key in response to an authen- 
tication parameter received by said radio transceiver 
over said wireless connection. 

39. The wireless access communication unit of claim 38, 
wherein said authentication key comprises a signed 
response, wherein said radio transceiver transmits said 
signed response over said wireless connection to said base 
station. 

40. The wireless access communication unit of claim 38, 
wherein said authentication key comprises a ciphering key, 
wherein said controller encrypts and decrypts information 
transferred to and from said subscriber interface using said 
ciphering key. 

***** 
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